The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The file references/DECOMPILE_STRATEGY.md includes instructions to download an executable JAR file (cfr-0.152.jar) from https://xget.xi-xu.me/gh/leibnitz27/cfr/releases/download/0.152/cfr-0.152.jar. This third-party domain is not a trusted source and has been explicitly flagged as malicious by automated security scanners.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded binary file using java -jar within references/DECOMPILE_STRATEGY.md. Running binaries from unverified, non-trusted, and flagged domains creates a significant risk of remote code execution.
[COMMAND_EXECUTION]: The skill uses several shell commands, such as grep, find, and curl, to scan source code and download external components.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) because it processes untrusted input while having high-privilege capabilities.
Ingestion points: The skill reads project source code, compiled .class files, and .jar archives as specified in SKILL.md and references/DECOMPILE_STRATEGY.md.
Boundary markers: Absent; there are no instructions to use delimiters or ignore potentially malicious prompts embedded within the files being audited.
Capability inventory: The skill can execute shell commands (grep, find, curl) and run external Java binaries (java -jar) as documented in SKILL.md and references/DECOMPILE_STRATEGY.md.
Sanitization: No sanitization or validation of the input source code or byte code is performed before analysis.

java-xxe-audit