The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated security scanners (URLite) have blacklisted the documentation URL https://jeffallan.github.io/claude-skills/skills/security/secure-code-guardian/ referenced in the skill's metadata and documentation links.
[EXTERNAL_DOWNLOADS]: The SKILL.md file is flagged by reputation scanners as FileRepMalware. While this may be a false positive triggered by the inclusion of instructional security payloads (e.g., SQL injection and XSS strings used for validation examples), it constitutes a confirmed detection by automated tools.
[METADATA_POISONING]: The skill's metadata identifies the author as Jeffallan, which contradicts the provided developer context identifying the author as harshsinghmp.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external code and security requirements, which serves as a potential vector for indirect prompt injection.
Ingestion points: User-provided source code and configuration files are ingested across all reference files and the main skill body.
Boundary markers: The skill lacks technical delimiters to isolate processed code from agent instructions, increasing the risk of the agent obeying instructions embedded in the analyzed data.
Capability inventory: The skill references powerful Node.js libraries and system capabilities such as child_process.execFile (in references/input-validation.md) and database operations via pg.
Sanitization: While the skill advocates for sanitization best practices (e.g., Zod, DOMPurify) for the target application, it lacks internal mechanisms to sanitize the data it processes before it influences the agent's logic.

secure-code-guardian