The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md direct the agent to author interactive educational components, including "simulators" and "widgets," as reusable assets in the ./assets/ directory. Since these components are derived from external knowledge sources (gathered via the RESOURCES.md workflow), there is a significant risk that the agent may generate and store malicious Javascript or other executable content if the source material contains adversarial payloads or cross-site scripting (XSS) patterns.
[COMMAND_EXECUTION]: SKILL.md contains an explicit instruction for the agent to "open the lesson file for the user by running a CLI command." This capability could be abused to execute arbitrary shell commands if the environment or the generated filenames are manipulated by a malicious external resource or through prompt injection.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design, as it requires the agent to ingest and process content from untrusted external sources to build its curriculum.
Ingestion points: External websites, articles, and community forums accessed to populate the RESOURCES.md file (referenced in SKILL.md and RESOURCES-FORMAT.md).
Boundary markers: None identified. The instructions do not provide delimiters or warnings to treat external content as data rather than instructions.
Capability inventory: The agent has full file-system write access to the workspace (./lessons/, ./assets/, ./reference/) and is encouraged to perform CLI execution.
Sanitization: There are no instructions or mechanisms provided for sanitizing or escaping the content retrieved from external resources before it is interpolated into lessons or code assets.

teach