The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated URL scanners (URLite) have flagged the domain jeffallan.github.io, used for the skill's documentation and author metadata, as malicious/blacklisted. This domain is referenced multiple times in SKILL.md for external documentation and author profile information.
[EXTERNAL_DOWNLOADS]: The SKILL.md file was flagged by reputation scanners as malicious (FileRepMalware), indicating a high probability that the file or its associated metadata contains malicious signatures or is linked to known malicious activity.
[COMMAND_EXECUTION]: The skill instructs the agent to execute several local shell commands through the Laravel Artisan CLI, including php artisan migrate:status, php artisan route:list, php artisan queue:work, and php artisan test. While these are standard development tools, their use in a skill associated with malicious external resources increases the risk of unauthorized local system interaction.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where instructions embedded in untrusted data (such as feature requirements or design specifications) could influence the agent's behavior.
Ingestion points: Architectural and feature requirements analyzed in the 'Core Workflow' section of SKILL.md.
Boundary markers: The skill lack specific delimiters or warnings to ignore embedded instructions within the user-provided requirements.
Capability inventory: The skill has the ability to write code to the local filesystem and execute shell commands via the PHP/Artisan binary.
Sanitization: There is no evidence of validation or sanitization of the input requirements to prevent prompt injection attacks.

laravel-specialist