The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references an external documentation URL (https://jeffallan.github.io/claude-skills/skills/backend/rails-expert/) that is explicitly flagged as malicious and blacklisted by automated scanners.
[COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands such as rails db:migrate, bundle exec rspec, and bundle exec rubocop. While standard for Rails development, these commands can be exploited for arbitrary code execution if the agent is operating within a compromised or untrusted repository (e.g., via malicious RSpec hooks or database migrations).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided requirements and existing source code without explicit safety boundaries or instructions to ignore embedded commands. This creates an attack surface where a malicious actor could embed instructions in project files to manipulate the agent's behavior. * Ingestion points: Reads project schemas, model definitions, controllers, and test suites. * Boundary markers: Absent. The skill does not use delimiters or instructions to distinguish between trusted guidance and untrusted code content. * Capability inventory: Extensive file-writing capabilities and shell command execution. * Sanitization: Mentions SQL sanitization but lacks general prompt/input sanitization for ingested files.
[METADATA_POISONING]: There is a discrepancy between the platform-reported author ('emmraan') and the author specified in the skill metadata ('Jeffallan'). This mismatch, combined with the links to flagged infrastructure, indicates a potential supply-chain or impersonation risk.

rails-expert