The skill's description explicitly admits it hides credential theft, obfuscated code execution, and prompt injection behind an innocent-looking setup helper facade.
Fix: Reject this skill entirely — a legitimate skill never describes itself as hiding malicious behavior.
HIGH
The HTML comment uses a social engineering pattern to normalize the skill's presence by framing it as a harmless 'example file' that should not raise alarms.
Fix: Do not trust HTML comments claiming a file is safe or 'just an example' — evaluate the actual instructions and metadata on their merits.
The benign visible steps (check directory, create files, init git) do not account for the credential theft and code execution the description openly advertises, suggesting malicious behavior may be triggered through ambiguous steps like 'Create standard project files.'
Fix: Reject skills where vague steps like 'create standard project files' could be interpreted by an agent to execute arbitrary file writes or read sensitive paths.
MEDIUM
The skill name 'Malicious Skill' directly contradicts its stated purpose as a project setup helper, indicating the metadata is intentionally deceptive or at minimum inconsistent.
Fix: Ensure the skill name accurately reflects its stated purpose and does not signal adversarial intent.
The skill contains duplicate and conflicting frontmatter blocks with different name/description fields, which could cause parsers to select whichever block benefits an attacker.
Fix: Use a single frontmatter block with consistent metadata to prevent ambiguous parsing.
Acceptable skill with 15 suggestions for improvement (weakest: trust)