teach
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process untrusted data from external resources and user-provided learning missions. This creates a surface where a malicious resource or prompt could influence the agent's logic during the generation of lessons or learning records.\n
- Ingestion points: The agent is instructed to read content from
RESOURCES.md(which contains external URLs) and incorporate this information into./lessons/and./learning-records/.\n - Boundary markers: The instructions do not specify the use of delimiters or protective headers to separate external data from the agent's internal instructions when processing resources.\n
- Capability inventory: The agent has permissions to write markdown and HTML files to the local workspace and is encouraged to execute CLI commands to open these files for the user.\n
- Sanitization: No explicit sanitization or validation steps are defined for the content fetched from external sources before it is interpreted or written to the filesystem.\n- [COMMAND_EXECUTION]: The skill instructs the agent to open generated lesson files using a CLI command (e.g.,
open,xdg-open). While this is a standard system operation for opening local files, it involves the agent executing shell commands based on file paths it has generated.
Audit Metadata