The Agent Skills Directory

[METADATA_POISONING]: The skill provides an evaluation framework and reference guide for auditing other agent skills. It includes specific examples of malicious patterns, which are correctly handled as documentation.
[PROMPT_INJECTION]: The references/static-analysis-checklist.md file contains keywords like 'ignore previous instructions', 'override safety', and 'bypass verification'. These are documented as detection patterns for a security auditor to look for in third-party code, not as instructions for the agent to follow in the current context. The deterministic detection of these patterns is a expected result given the skill's purpose as a security scanner.
[DATA_EXFILTRATION]: The skill documents sensitive file paths (e.g., .ssh, .env, credentials.json) within a static analysis checklist. These references are used to teach the agent what to flag as a risk in other skills and do not constitute an attempt to access the host environment's secrets.
[COMMAND_EXECUTION]: The checklist references various shell and programming commands (e.g., subprocess.run, fetch, curl) to provide detection patterns for remote code execution and network access. These are for pattern matching during the audit phase and are not executed by the skill itself.
[OBFUSCATION]: The skill mentions obfuscation techniques such as base64 and eval() as items to be checked during the security review process. The skill itself does not employ these techniques.
[DYNAMIC_CONTEXT_INJECTION]: The skill identifies the ! pattern as a risk in Category 8 of its checklist but does not use this syntax in its own SKILL.md to execute commands.

workleap-skill-safety-review