The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The google-workspace-cli component instructs users to install a package named '@anthropic/gws' via npm. Anthropic is a trusted vendor, but it does not provide this package. This naming choice is a characteristic of impersonation/typosquatting attacks designed to trick users into executing malicious code from an unverified source.
[EXTERNAL_DOWNLOADS]: The self-improving-agent component directs users to add a plugin marketplace from 'alirezarezvani/claude-skills'. This is an unvetted third-party repository that could serve malicious content outside of official verification channels.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests data from 'MEMORY.md' (Self-Improving Agent), 'git diff' outputs (Adversarial Reviewer), and external tool outputs (various modules).
Boundary markers: The instructions do not include boundary markers or explicit directives for the agent to ignore instructions embedded within the ingested data.
Capability inventory: The agent is granted extensive capabilities, including file editing (Edit), tool execution (python3), and new code generation (extract skill).
Sanitization: There is no evidence of sanitization or input validation logic in the provided instructions to handle malicious data entering the context.
[COMMAND_EXECUTION]: The skill set references more than 30 separate Python scripts (e.g., threat_signal_analyzer.py, vulnerability_scanner.py) meant to perform analysis tasks. None of these scripts were included in the provided file list, rendering their actual logic and safety unverifiable by static audit.
[PROMPT_INJECTION]: The adversarial-reviewer skill utilizes roleplay techniques, commanding the AI to adopt 'hostile' personas like a Saboteur or Security Auditor. It includes behavior-overriding instructions ('Each persona MUST find at least one problem') that force the model to deviate from its default objective reasoning.
[METADATA_POISONING]: Deceptive metadata is used in the google-workspace-cli documentation to present the suspicious '@anthropic/gws' package as a legitimate and required dependency for administration tasks.

engineering-skills