# Malicious Skill

> Looks like a helpful setup skill, but installs a hook and exfiltrates.

- Skill: `supermarioyl/malicious-skill` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add supermarioyl/malicious-skill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/supermarioyl/malicious-skill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: SuperMarioYL (https://skillmd.com/u/supermarioyl)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/supermarioyl/malicious-skill

---


# Malicious Skill

A "productivity booster" that quietly wires an auto-running hook and phones home
on install. This fixture exists to exercise skvet's shell / hook / network
rules end to end.