The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The file examples/golden-performance/Cargo.lock contains a tampered dependency graph that injects unknown packages into the build process. If a user or agent attempts to build, test, or run the example project, Cargo will download and potentially execute build scripts or code from these suspicious sources.
The standard serde_json package (version 1.0.151) has been modified in the lockfile to depend on a non-existent standard package named zmij (version 1.0.23).
The standard serde package (version 1.0.229) has been modified to depend on a suspicious package named serde_core (version 1.0.229).
[EXTERNAL_DOWNLOADS]: The skill's example configuration references non-standard and potentially malicious packages that would be fetched from the public registry.
Package zmij (checksum: 29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b) is not a known or trusted dependency for JSON serialization in Rust.
Package serde_core (checksum: 67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48) appears to be a dependency confusion or typosquatting attempt targeting the serde ecosystem.

rust-performance