The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructions mandate an "Executable Verification Pipeline" requiring the agent to execute student-submitted code against a test suite. This involves running untrusted code which may contain malicious payloads designed to perform unauthorized operations, escape execution environments, or consume excessive resources. While the skill mentions sandboxing, the core directive to execute external, untrusted code is a significant attack surface.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process student exercises, repositories, and essays. These untrusted inputs can be used for indirect prompt injection attacks, where malicious instructions are embedded in the student work to manipulate the agent's scoring, bypass pedagogical constraints (like the Socratic hint ladder), or abuse the agent's file system capabilities (such as write_file or edit_file) to modify project files or export sensitive assessment data.
[METADATA_POISONING]: There is a clear contradiction between the primary skill instructions and the platform-specific metadata. SKILL.md defines a Bayesian Knowledge Tracing (BKT)-informed 4-tier rubric based on percentages (0-100%), whereas agents/openai.yaml specifies a "Vietnamese 10-point scale" and "MOET-aligned feedback." This discrepancy can lead to inconsistent agent behavior, incorrect scoring logic, and user confusion regarding the grading standards being applied.

grade-and-review