The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated security scans (URLite) have identified the documentation link https://jeffallan.github.io/claude-skills/skills/language/cpp-pro/ referenced in SKILL.md as a blacklisted malicious URL. Additionally, the file SKILL.md itself was flagged by file reputation scanners as potentially malicious (FileRepMalware).
[REMOTE_CODE_EXECUTION]: The references/build-tooling.md file encourages the use of CMake's FetchContent module and the Conan package manager to download and compile external source code from remote repositories. While these are common development tools, they introduce a remote code execution surface during the build process if the remote sources or registries are compromised.
[COMMAND_EXECUTION]: The skill includes documentation for executing various shell-based tools such as clang-tidy, cppcheck, valgrind, and conan (e.g., in references/build-tooling.md). Instructing an agent to run these commands on unvetted project files can be exploited to execute arbitrary code or system commands if the file paths or configurations are manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process C++ source code and build configurations, which serve as untrusted data inputs.
Ingestion points: C++ source files and CMakeLists.txt files (referenced in SKILL.md Core Workflow).
Boundary markers: Absent. There are no instructions for the agent to use delimiters or ignore instructions potentially hidden in code comments or string literals.
Capability inventory: The skill has the capability to write new code files (Output Templates) and execute shell commands for analysis and builds (references/build-tooling.md).
Sanitization: The skill does not specify any sanitization or validation for the code it processes before using it in the output generation or command execution.

cpp-pro