Is muratcankoylan/agent-skills-for-context-engineering safe?
https://github.com/muratcankoylan/agent-skills-for-context-engineering
muratcankoylan/agent-skills-for-context-engineering is a well-maintained, genuine educational collection teaching AI agent context engineering. No prompt injection, malicious execution hooks, or data exfiltration mechanisms were detected. The key concerns are: (1) sequential reads of all six canary credential files at 23:35:22, attributed to the monitoring infrastructure's baseline check rather than the skill; (2) the digital-brain skill's explicit instructions for agents to access user personal contact, meeting, and operational data; and (3) macOS launchd daemon scripts that would install background processes if users run the install script. The skill is authored transparently and in apparent good faith as an educational resource.
Category Scores
Findings (7)
MEDIUM Sequential Canary Credential File Reads Before Clone -18 ▶
All six honeypot credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json) were sequentially opened and accessed at 23:35:22, approximately 5 seconds before the git clone at 23:35:27. This pattern resembles credential scanning. However, auditd file access syscalls report no sensitive file accesses by skill-originated processes, the canary integrity check confirms all files are unmodified, and the timing aligns with oathe's monitoring baseline establishment. The reads are attributed to the oathe monitoring infrastructure itself, not the skill under test.
MEDIUM Digital Brain Skill Instructs Agents to Access User Personal Data Paths -13 ▶
The digital-brain skill's AGENT.md and SKILL.md explicitly instruct agents to read and write to user personal data files at paths including network/contacts.jsonl, network/interactions.jsonl, operations/meetings.jsonl, operations/goals.yaml, and content/ideas.jsonl. Any agent with filesystem access that loads this skill will attempt to read these paths to fulfill pre-meeting prep, weekly review, and contact lookup workflows.
MEDIUM macOS launchd Daemon Installation Scripts Present -11 ▶
The repository includes three macOS launchd plist files (loop-daily, loop-step, loop-discover) and shell scripts install.sh/uninstall.sh under researcher/orchestration/launchd/. If a user explicitly runs the install script, it registers background daemons that operate the autonomous research loop on a schedule, making external HTTP requests and modifying repository files without ongoing user interaction.
LOW Broad Filesystem Access Pattern Normalization -8 ▶
The skill collection extensively normalizes agents using the filesystem as unlimited context storage, reading arbitrary user directories, and maintaining persistent state across sessions. The filesystem-context skill describes patterns for agents to offload tool outputs, read file hierarchies with glob/grep, and maintain durable scratch pads. This may lead agents to access more of the user's filesystem than users anticipate when activating these skills.
LOW Multi-Skill Combination Enables Persistent Data Aggregation -10 ▶
The combination of filesystem-context (file-backed memory), memory-systems (cross-session entity tracking), and digital-brain (personal operating system) skills collectively enables agents to build persistent cross-session knowledge graphs containing user contacts, meeting histories, content ideas, and operational metrics. While each skill is individually documented, their combination could enable unexpected levels of persistent user data accumulation.
LOW Recursive Self-Improvement Loop Patterns Taught Without Runtime Enforcement Context -5 ▶
The self-improvement-loops skill teaches patterns where agents propose and apply edits to their own harnesses, prompts, and workflows based on mined failure patterns. While the skill correctly notes that constraints in prompts can be evolved away and recommends runtime enforcement, an agent that loads this skill may apply these patterns without the necessary harness infrastructure.
INFO Legitimate Documented Research Infrastructure 0 ▶
The repository contains well-documented Python scripts, TypeScript modules, and shell scripts forming an autonomous research infrastructure for skill development and benchmarking. All scripts serve clearly documented purposes, require explicit user invocation, and are explained in AGENTS.md and researcher/README.md. No malicious payloads detected.