The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation URL https://jeffallan.github.io/claude-skills/skills/language/rust-engineer/ has been identified as malicious by automated scanners (URL:Blacklist).
[REMOTE_CODE_EXECUTION]: The skill recommends running cargo clippy, cargo test, and cargo bench. In the context of an AI agent, these commands can execute arbitrary code provided in an untrusted project's build.rs or test suites.
[COMMAND_EXECUTION]: Instructs the agent to invoke the shell for cargo-based validation and testing, which can lead to host compromise if project files are malicious.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external codebases which represents an indirect prompt injection surface. Evidence: 1. Ingestion points: Rust source files and project configurations (SKILL.md, references/testing.md). 2. Boundary markers: None present. 3. Capability inventory: Subprocess execution of cargo tools (SKILL.md). 4. Sanitization: No validation of project integrity before command execution.
[METADATA_POISONING]: There is an inconsistency in the author information; the skill metadata lists Jeffallan while the deployment context attributes it to emmraan. The linked author profile is associated with a blacklisted domain.

rust-engineer