The Agent Skills Directory

[NO_CODE]: The skill consists exclusively of markdown documentation, transcripts, and curated notes. There are no executable scripts (.js, .py, .sh), build steps, or configuration files that grant permissions to the environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests a large amount of external reference data (scraped content from colorandcontrast.com and huevaluechroma.com).
Ingestion points: 144 reference markdown files in the references/ directory.
Boundary markers: The content is presented as static documentation for the agent to read as a knowledge base. No explicit boundary markers like XML tags are used for individual fragments, but the files are clearly labeled as third-party references.
Capability inventory: None. The skill does not execute subprocesses, network calls, or file writes.
Sanitization: Content is human-curated and edited by the maintainer to ensure it remains factual and safe.
[OBFUSCATION]: A base64-encoded string was detected in references/contemporary/colorandcontrast/color-spaces.md. Analysis reveals this is a valid data URI for a PNG image (data:image/png;base64,...) used for visual illustration of color gamuts. It does not decode to executable commands or hidden instructions.
[METADATA_POISONING]: The SECURITY.md file contains self-referential claims about the skill's safety and addresses previous automated scan findings. While this content targets security analysis, it does not attempt to exploit the agent or override its behavior.
[EXTERNAL_DOWNLOADS]: The README.md and various reference files contain many URLs to color tools, libraries, and historical archives (e.g., archive.org, gutenberg.org, github.com). These are documented neutrally as educational resources and do not involve silent runtime downloads or execution.

color-expert