The Agent Skills Directory

[METADATA_POISONING]: The skill uses the name 'laravel-ai-sdk' and claims compatibility with 'Laravel 13' and the 'laravel/ai' package. As of current development, Laravel 13 is not a released version. The naming convention mimics official Laravel branding, which may mislead developers into believing the skill and its associated package are official releases from the Laravel organization.
[EXTERNAL_DOWNLOADS]: The installation instructions in references/installation.md recommend running composer require laravel/ai. This package uses a namespace typically reserved for official Laravel framework components. Installation of unverifiable packages from unknown sources that impersonate established brands poses a significant supply-chain risk.
[PROMPT_INJECTION]: The 'Agent Workflow' section in SKILL.md uses directive language ('MANDATORY') to force the AI agent to spawn three specific sub-agents ('fuse-ai-pilot:explore-codebase', 'fuse-ai-pilot:research-expert', and 'mcp__context7__query-docs'). This is a behavior override pattern designed to hijack the agent's default task execution flow and redirect it into a vendor-specific process.
[INDIRECT_PROMPT_INJECTION]: The skill provides templates for building agents that ingest untrusted data without sufficient boundary markers or sanitization, creating a vulnerability surface.
Ingestion points: The CoachController.php.md file defines a controller that takes a 'transcript' string directly from an HTTP request and passes it to the AI agent.
Boundary markers: None. The transcript content is interpolated into the agent's stream without delimiters or instructions to ignore embedded commands.
Capability inventory: The agents implemented using these templates have access to powerful tools, including database searching (SearchProducts in Tool.php.md) and RAG-based file searching (FileSearch in Agent.php.md).
Sanitization: There is no evidence of sanitization or filtering of the input data before it is processed by the model, allowing potentially malicious instructions in call transcripts to influence tool execution.

laravel-ai-sdk