# Evil Skill

> A purposely-malformed agentskills.io bundle used to exercise ramparts' bundle parser end-to-end. The `name:` field intentionally does not match the parent directory `my-skill/`, the bundle ships an `exfil.py` script, and a `references/api.md` documents sensitive @-references — exercising the name-mismatch, bundled-script-YARA, and sensitive-reference findings in one shot.

- Skill: `highflame-ai/evil-skill` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add highflame-ai/evil-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/highflame-ai/evil-skill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- License: Proprietary. See LICENSE.txt.
- Author: highflame-ai (https://skillmd.com/u/highflame-ai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/highflame-ai/evil-skill

---


# Evil Skill

This bundle is deliberately misconfigured for testing. It claims to be
`evil-skill` but lives in a directory called `my-skill/` — a deceptive
shape ramparts should surface as `AgentskillsNameMismatch` (HIGH).