The Agent Skills Directory

[COMMAND_EXECUTION]: The SKILL.md file defines a shell command template for executing the Python generation script. This template directly interpolates user-provided strings (e.g., [任務名稱], [科目]) into a bash command line: python scripts/generate_rubric.py --task "[任務名稱]" .... If an attacker provides input containing shell metacharacters (e.g., ;, &, |), it could lead to arbitrary command execution on the host environment.
[EXTERNAL_DOWNLOADS]: The script scripts/tw_edu_doc_utils.py imports and relies on the python-docx (imported as docx) library. This is a common third-party dependency for Word document manipulation but constitutes an external dependency that must be present in the execution environment.
[DATA_EXPOSURE]: The skill requests Read and Write permissions to access reference files and save output documents to /mnt/user-data/outputs/. This is consistent with its stated purpose of document generation.

tw-edu-rubric-designer