建议通过未指定的 CLI 命令打开生成的 HTML
原文依据:4 处Skill 指示代理尽可能运行命令打开课程文件,但没有限定允许的命令、浏览器或确认流程。课程还可能包含交互式脚本和共享组件。
代理可能调用系统默认处理程序并执行生成页面中的脚本;若工作区已有被篡改的共享资产,打开页面会使其在本地浏览器环境中运行。现有证据没有表明这种滥用必然发生。
来源确实建议通过 CLI 打开生成的课程,并允许课程使用交互式组件;打开本地 HTML 时,其中的脚本可能运行。不过没有提供具体命令、脚本实现、外部程序参数或自动执行要求,因此无法从现有证据判断会调用不安全命令或执行恶意内容。这也是展示用户请求课程的正常操作。用户可要求仅生成文件而不自动打开,或在运行任何命令前显示完整命令并确认。
这项判断针对展示的代码和适用条件,不表示风险已经实际发生。If possible, open the lesson file for the user by running a CLI command.查看另外 3 个位置
Lessons are built from reusable **components**, stored in `./assets/`: stylesheets, quiz widgets, simulators, diagram helpers, and anything else a second lesson could reuse.Reuse is the default, not the exception. Before authoring a lesson, read `./assets/` and build from the components already there. When a lesson needs something new and reusable, write it as a component in `./assets/` and link to it; never inline code a future lesson would duplicate.For skill acquisition, difficulty is the tool. Effortful retrieval is what builds storage strength. Skills should be taught through interactive lessons. There are several tools at your disposal:- Interactive lessons, using quizzes and light in-browser tasks- Lessons which guide the user through a list of real-world steps to take (for instance, yoga poses)- Interactive lessons, using quizzes and light in-browser tasks- Lessons which guide the user through a list of real-world steps to take (for instance, yoga poses)