The Agent Skills Directory

[DATA_EXPOSURE]: The skill instructions specify that the agent must read a file from a hardcoded absolute path: /Users/vishal/admin/teaching-philosophy-context.md. Accessing local files using absolute paths to directories such as admin can expose information about the host environment's structure, though in this case, it appears to be a configuration file specific to the author's environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves parsing untrusted content from user-provided URLs and passing it to multiple subagents, creating a surface for indirect prompt injection.
Ingestion points: External content is retrieved using the WebFetch tool and Chrome browser automation (via mcp__claude-in-chrome__navigate and read_page) as described in the Phase 1 parsing strategy.
Boundary markers: The skill lacks explicit delimiters or instructions to the subagents (Haiku and Sonnet) to ignore potentially malicious instructions embedded within the fetched syllabus or course content.
Capability inventory: The skill possesses significant capabilities, including the ability to spawn subagents with different models, write multiple files to the local filesystem, and execute the mkdocs build shell command.
Sanitization: There is no mechanism described for sanitizing or validating the retrieved text before it is used as context for the content generation subagents.
[COMMAND_EXECUTION]: The skill instructs the agent to run the mkdocs build command during the final assembly phase. While this is a standard tool for the intended output format, the execution of shell commands on data derived from untrusted external URLs without sanitization represents a security boundary risk.

course-generator