The Agent Skills Directory

[COMMAND_EXECUTION]: The file agents/alignment_auditor_agent.md instructs the agent to execute local shell commands: python3 scripts/check_passport.py <passport> --json and python3 scripts/check_alignment_gate.py <passport> --json. Because the source code for these scripts is not included in the skill documentation or file list, their behavior, safety, and potential for side effects (such as data exfiltration or system modification) cannot be verified.
[PROMPT_INJECTION]: The skill is designed to process untrusted external content, creating a vulnerability surface for indirect prompt injection.
Ingestion points: External data enters the agent context through 'intake context' and 'old syllabi' inputs mentioned in SKILL.md and processed via agents/design_mentor_agent.md and agents/outcome_architect_agent.md.
Boundary markers: The instructions do not define strict boundary markers (e.g., XML tags or specific delimiters) to isolate untrusted user data from agent instructions.
Capability inventory: The skill possesses powerful capabilities, including shell command execution (python3) in agents/alignment_auditor_agent.md and filesystem write access for generating artifacts (course_passport.yaml, syllabus.md).
Sanitization: There is no evidence of sanitization or validation of external data before it is interpolated into prompts or processed by scripts, which could allow malicious instructions embedded in a syllabus to influence the agent's behavior.
[SAFE]: The metadata in SKILL.md contains a future-dated last_updated field ("2026-06-10"), which is a minor discrepancy but does not appear to be part of a malicious campaign based on currently available information.

course-designer