The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill encourages the acquisition of project templates and base patterns from an unverified repository at https://github.com/wshobson/agents. This source is not associated with a trusted organization or well-known service.
[REMOTE_CODE_EXECUTION]: The instructions recommend using bun x skills add or npx skills add with a remote URL to fetch and integrate code. These commands execute external content from the provided URL, allowing for the execution of arbitrary scripts from an untrusted source during the project scaffolding process.
[METADATA_POISONING]: The skill contains deceptive technical claims, specifically referencing a non-existent FastAPI version (0.135.0) and a non-existent module (fastapi.sse). This could lead developers to search for or install malicious packages masquerading as these 'new' features.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a code generation assistant that processes user prompts to build APIs. It lacks explicit instructions for boundary markers or sanitization when generating logic based on untrusted user input, creating a surface for indirect prompt injection where malicious instructions could be embedded in the generated application logic.

fastapi-guideline