The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's catalog contains entries that link to and promote a blacklisted malicious URL (https://jevtypesafeai.com). This domain is a typosquatting attempt to impersonate the legitimate typesafe.ai service and has been flagged by security scanners for malicious activity.
Evidence: Found in multiple project receipt files, such as radar/receipts/2026-10-02T22-00-17.487Z.json, as part of the evidence and descriptions for the codaaiteam/jev-mcp project.
[METADATA_POISONING]: Automated scans have flagged a data file within the repository as malware. This file contains snapshots of external project metadata, including malicious links and deceptive descriptions derived from untrusted third-party sources.
Evidence: radar/receipts/2026-09-28T04-41-05.643Z.json flagged as FileRepMalware.
[DYNAMIC_EXECUTION]: The build system includes a self-healing script (scripts/mos-self-heal.mjs) that executes logic based on output from an external AI model (Meta/OpenRouter). While the actions are currently restricted to a predefined list, using external model output to control build-time operations creates a potential surface for exploitation if the model or its communication channel is compromised.

awesome-jev