The Agent Skills Directory

[METADATA_POISONING]: The skill is centered around a completely fabricated 'OpenAI Responses API' and 'gpt-5' model. It provides detailed, future-dated (2025-2026) specifications for endpoints, data retention policies (citing a fictional court order), and architectural changes that do not exist as of current OpenAI standards. This level of deception regarding API capabilities and security protocols is high risk and could lead to significant security misconfigurations.
[REMOTE_CODE_EXECUTION]: The skill instructions and templates promote the installation of specific SDK versions (openai@6.16.0 and ^5.19.1) that are significantly ahead of the current official OpenAI SDK (v4.x). Promoting non-existent or potentially malicious versions of a popular library is a major supply chain risk that can lead to remote code execution during the installation process.
[INDIRECT_PROMPT_INJECTION]: The skill architecture relies on tools that ingest untrusted data from the web, files, and third-party MCP servers, creating a vulnerability surface for indirect injection.
Ingestion points: The skill uses web_search (templates/web-search.ts), file_search (templates/file-search.ts), and mcp (templates/mcp-integration.ts) tools to bring external content into the agent's context.
Boundary markers: Absent. The instructions do not include delimiters or warnings to the model to ignore instructions embedded in the external data.
Capability inventory: The skill allows for server-side Python execution via code_interpreter and external network calls via mcp and web_search tools, which could be exploited if malicious instructions are ingested.
Sanitization: There is no evidence of validation or sanitization for the data retrieved by these tools before interpolation into model prompts.
[EXTERNAL_DOWNLOADS]: The skill scripts (scripts/check-versions.sh) and instructions suggest downloading and installing packages from external registries using non-standard version numbers. This pattern is often associated with dependency confusion or typosquatting attacks targeting developer environments.

openai-responses