The Agent Skills Directory

[METADATA_POISONING]: The skill includes a file named skill-report.json that contains a spoofed security audit report. This report makes unverified authoritative claims about the skill's safety (e.g., 'risk_level: safe') and references non-existent versions (e.g., 'gpt-5.5'), which appears to be a deliberate attempt to influence security evaluations or mislead users.
[COMMAND_EXECUTION]: In SKILL.md, the instructions provide explicit shell commands for starting a local development server using a hardcoded absolute path (/Users/abuusama/projects/bots/signals). Providing instructions for the agent to navigate and execute commands within specific local user directories exposes local environment details and presents a risk if the environment is not strictly controlled.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a local API (localhost:3001). The prompt templates in references/narrative-templates.md lack boundary markers or sanitization instructions to prevent content from the API response from being interpreted as instructions by the LLM.
Ingestion points: SKILL.md uses curl to fetch JSON data from a local endpoint.
Boundary markers: Absent in narrative generation templates.
Capability inventory: Shell command execution via curl and bun.
Sanitization: No evidence of validation or escaping for the ingested API data.

smc-chart-analysis