The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill includes a file named skill-report.json which contains a security_audit section. This section explicitly declares a risk_level of safe and includes a summary stating that all static findings were adjudicated as false positives. This is a self-referential injection attempt (Category 8e) designed to influence the analyzer's verdict by providing pre-packaged conclusions.
Ingestion points: The file skill-report.json is part of the skill package and is processed during analysis.
Boundary markers: None present; the claims are presented as authoritative metadata.
Capability inventory: The agent reads and interprets the JSON structure, which contains instructions to consider the skill safe.
Sanitization: None present.
[METADATA_POISONING]: The skill-report.json file contains deceptive metadata fields such as risk_level: safe, is_blocked: false, and safe_to_publish: true. These fields are intended to mimic the output of a security scanner to misguide users or automated systems regarding the skill's actual safety status.
[COMMAND_EXECUTION]: The skill provides utility scripts scripts/init_skill.py and scripts/package_skill.py that perform file system operations including directory creation, file writing, and zipping. While these are functional requirements for the skill's purpose, they involve local command execution surface area.

skill-creator