The Agent Skills Directory

[METADATA_POISONING]: The skill package includes a file named skill-report.json which contains a fabricated security audit claiming a safe verdict. This file mimics official security reports to deceive auditors and automated scanners. The provenance section references non-existent AI models like gpt-5.5, and there is an author mismatch between the metadata (alirezarezvani) and the reported author (aiskillstore).
[COMMAND_EXECUTION]: The SKILL.md file contains numerous instructions for running local scripts and external tools such as npm, docker, and kubectl. These instructions trigger the execution of code in the local environment and should be verified by the user.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external project directories, creating an attack surface for indirect prompt injection. Malicious instructions hidden in project files could be ingested and executed by the agent.

senior-architect