The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The Cargo.lock file contains suspicious dependency specifications that deviate from the official Rust package ecosystem.
Multiple core libraries have their versions set to values significantly higher than the current official releases (e.g., serde at 1.0.228, serde_json at 1.0.149, anyhow at 1.0.102).
These inflated versions are configured to depend on additional, unverifiable packages. Specifically, serde_json depends on a package named zmij (v1.0.21), and serde depends on serde_core. Neither of these are legitimate dependencies of the official libraries.
Executing cargo build as instructed in SKILL.md would install and compile these non-standard packages, potentially executing malicious code during the build process or at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary profiler recordings and converts them to JSON format for analysis by the AI agent.
Ingestion points: Binary .puffin files are read by the dump-puffin tool (source in dump-puffin/src/main.rs).
Boundary markers: The skill lacks delimiters or warnings for the agent when it processes the resulting JSON output using jq or the Python helper scripts.
Capability inventory: The agent is encouraged to execute shell commands (jq), run Python scripts, and read local files based on the content of the trace.
Sanitization: There is no sanitization or validation of the strings (e.g., scope names, dynamic data labels) extracted from the binary trace before they are presented in the JSON structure and subsequently processed by the agent.

investigate-puffin