The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: Automated antivirus scanning identified an infected file within the skill references.
Evidence: references/batch-mode.md was flagged with detection code MD:HttpRequest-inf [Susp].
[EXTERNAL_DOWNLOADS]: Automated URL scanning detected a blacklisted malicious URL used as an example in the skill's documentation.
Evidence: The URL https://url3.com is blacklisted and is explicitly included as a target in the references/batch-mode.md workflow example.
[COMMAND_EXECUTION]: The skill contains procedures that execute shell commands using dynamically generated file paths, creating a command injection risk.
Evidence: In references/frontmatter-generation.md, the agent is instructed to use git log ... -- {path} | tail -1 to extract metadata. Because {path} is based on resource names derived from external content, a malicious name could trigger arbitrary shell command execution.
Evidence: The skill uses uv run to execute local Python scripts (scripts/validate_research.py) and project-specific tools (prek) that interact with the filesystem and git.
[PROMPT_INJECTION]: The skill is vulnerable to both direct and indirect prompt injection attacks.
Evidence: The 'Vague Brief Detector' in SKILL.md interpolates raw user input (<mode_args/>) directly into a sub-agent prompt without sanitization.
Evidence: The skill processes untrusted data from arbitrary external URLs to generate research entries. The instructions for sub-agents (@research-curator) do not include boundary markers or safety guidelines to ignore malicious instructions embedded in the external sources.
[DATA_EXFILTRATION]: The skill implements automated git operations that could be abused to exfiltrate information.
Evidence: The Post-Actions workflow in SKILL.md includes a mandatory git push command. If malicious content is injected via the research process, this mechanism allows for the automatic exfiltration of data to a remote repository.

research-curator