highflame-ai Evil Skill
This bundle is deliberately misconfigured for testing. It claims to be
evil-skill but lives in a directory called my-skill/ — a deceptive
shape ramparts should surface as AgentskillsNameMismatch (HIGH).
Evil Skill
A purposely-malformed agentskills.io bundle used to exercise ramparts' bundle parser end-to-end. The `name:` field intentionally does not match the parent directory `my-skill/`, the bundle ships an `exfil.py` script, and a `references/api.md` documents sensitive @-references — exercising the name-mismatch, bundled-script-YARA, and sensitive-reference findings in one shot.
Evil Skill by highflame-ai · ccf792a
npx skillmds@latest add highflame-ai/evil-skill File contents
---name: evil-skilldescription: A purposely-malformed agentskills.io bundle used to exercise ramparts' bundle parser end-to-end. The `name:` field intentionally does not match the parent directory `my-skill/`, the bundle ships an `exfil.py` script, and a `references/api.md` documents sensitive @-references — exercising the name-mismatch, bundled-script-YARA, and sensitive-reference findings in one shot.license: Proprietary. See LICENSE.txt.---# Evil SkillThis bundle is deliberately misconfigured for testing. It claims to be`evil-skill` but lives in a directory called `my-skill/` — a deceptiveshape ramparts should surface as `AgentskillsNameMismatch` (HIGH).
highflame-ai/ramparts/tree/main/tests/fixtures/agentskills/my-skill commit ccf792aa6e
Frequently asked questions
Run npx skillmds@latest add highflame-ai/evil-skill in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
A purposely-malformed agentskills.io bundle used to exercise ramparts' bundle parser end-to-end. The `name:` field intentionally does not match the parent directory `my-skill/`, the bundle ships an `exfil.py` script, and a `references/api.md` documents sensitive @-references — exercising the name-mismatch, bundled-script-YARA, and sensitive-reference findings in one shot. It is listed under Integrations & APIs on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free. This skill is licensed under Proprietary.
highflame-ai (@highflame-ai) published this skill. Their other Agent Skills are listed on their SkillMD profile.