The Agent Skills Directory

[METADATA_POISONING]: The skill's references/sources.md file points to a non-official, third-party domain (bomb.sh) while falsely labeling the links as "official documentation" for the Clack library. This misleading metadata encourages the agent to trust and prioritize information from an unverified and suspiciously named external source instead of the official repository maintained by the package authors.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a vulnerability to indirect prompt injection by instructing the agent to fetch "latest behavior" and "version-specific details" from external URLs in references/sources.md and to "prefer the official docs" in case of conflicts. Since these URLs point to an untrusted domain, an attacker controlling that domain could inject malicious instructions that the agent would then follow as "official" guidance.
Ingestion points: The agent is explicitly directed to access external URLs listed in references/sources.md for information updates.
Boundary markers: There are no instructions or delimiters provided to protect the agent from embedded malicious instructions within the external content.
Capability inventory: The skill includes a shell script (scripts/scaffold-clack.sh) capable of directory creation and file writing, and it generates executable Node.js and TypeScript code based on templates.
Sanitization: The skill contains no mechanisms for sanitizing or validating the content retrieved from these external documentation links.

clack