The Agent Skills Directory

[METADATA_POISONING]: The skill's YAML metadata identifies the author as 'Google LLC', which is deceptive as it contradicts the actual author context 'albertmartorell1975'. This misrepresentation could lead users to misplace trust in the skill's origin and instructions.
[EXTERNAL_DOWNLOADS]: The agent is instructed to download library sample JARs from dl.google.com. Although this is a well-known and trusted source, the instruction to fetch and process external artifacts is provided by a skill with deceptive author information.
[COMMAND_EXECUTION]: The skill uses shell commands including curl, unzip, and rm to manage a local cache of sample files in the /tmp directory. These operations are driven by version strings extracted from local project files.
[INDIRECT_PROMPT_INJECTION]: The skill exposes a vulnerability surface for indirect prompt injection.
Ingestion points: Reads local build configuration files (build.gradle.kts, libs.versions.toml) and processed code from downloaded library samples.
Boundary markers: Absent; there are no instructions to the agent to treat external content as data or ignore embedded commands.
Capability inventory: The agent utilizes shell commands (curl, unzip), file system access in /tmp, and possesses permissions for project-wide code refactoring.
Sanitization: Absent; the content from potentially untrusted project files and external samples is used directly to influence the agent's code generation output.

wear-compose-m3