skills/agentskillexchange/skills/Synchronize AI coding rules across agent tools with Rulesync/Gen Agent Trust Hub
Synchronize AI coding rules across agent tools with Rulesync
Warn
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: MEDIUMMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill provides misleading popularity statistics in its metadata. It claims 748,196 weekly NPM downloads and 1,217 GitHub stars, which do not align with the actual public metrics of the referenced 'rulesync' package. Additionally, the 'security_reviewed' verification status is a self-reported claim that cannot be independently verified.
- [EXTERNAL_DOWNLOADS]: The skill instructions direct users to perform a global installation of the 'rulesync' package using 'npm install -g' or Homebrew. This introduces third-party code into the execution environment.
- [INDIRECT_PROMPT_INJECTION]: The core functionality involves fetching AI coding rules from a remote repository ('dyoshikawa/rulesync') and applying them to agent tools like Claude Code or Cursor. This creates a surface where external, untrusted instructions can influence and potentially override the agent's operational guidelines and safety filters.
- Ingestion points: rulesync fetch command (SKILL.md)
- Boundary markers: None identified
- Capability inventory: File system writes (configuration generation), remote content fetching
- Sanitization: Not specified in instructions
Audit Metadata