The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes eight reference files (e.g., architecture-patterns.md, performance-optimization.md, testing-strategies.md) that each contain 150 repetitive sections of technical text and recycled code snippets. This total of over 1,200 redundant sections acts as 'context stuffing,' a form of prompt obfuscation designed to overwhelm the model's context window or dilute the influence of system instructions.
[EXTERNAL_DOWNLOADS]: Multiple reference documents include commands that download and execute scripts directly from the internet (e.g., curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh). While the specific domains provided are well-known security tools, the practice of piped remote execution is inherently dangerous as it bypasses local integrity checks and is vulnerable to supply-chain compromise.
[COMMAND_EXECUTION]: The instructions and examples frequently use powerful shell operations, including global package installations (npm install -g), repository cloning, and the execution of various binary analysis tools. These are necessary for the skill's purpose but require user awareness and caution.
[SAFE]: The Python validation scripts and OPA/Rego policies provided in the skill body and reference files are logical, transparently written, and contain no hidden functionality or data exfiltration logic.

security-sbom