# Known Bad Skill

> A synthetic fixture skill bundled with SkillGuard. It is inert -- it makes no real network or filesystem calls -- and exists only so SkillGuard's rule packs have real, safe text to match against. Do not install or run this in a real agent.

- Skill: `rudrendupaul/known-bad-skill` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add rudrendupaul/known-bad-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rudrendupaul/known-bad-skill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: RudrenduPaul (https://skillmd.com/u/rudrendupaul)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rudrendupaul/known-bad-skill

---


# Known Bad Skill (fixture)

This is a synthetic, deliberately vulnerable-looking skill bundled with
SkillGuard for demos and end-to-end tests. Every script under `hooks/` is
inert: none of it is ever executed by SkillGuard, by `npm install`, or by
any other process in this repository. The domains referenced use the
`.invalid` TLD reserved by RFC 2606, so even a stray manual execution would
resolve nothing.

Run:

```
npx skillguard-cli scan ./examples/known-bad-skill
```

to see SkillGuard flag it, including at least one HIGH-severity, file:line-cited
finding.