Is nidhinjs/prompt-master safe?

The skill names its opening section 'PRIMACY ZONE' and explicitly frames it as 'Identity, Hard Rules, Output Lock'. This is a deliberate use of authoritative labeling to establish the section's content as higher priority than surrounding instructions. While the content within it is benign and explicitly scopes the persona to prompt engineering only, the technique of asserting priority through naming is a recognized prompt injection pattern. Combined with the README's documentation of 'PAC2026 positional structure' to exploit attention architecture, the skill's author clearly understands and applies LLM attention manipulation.

The skill uses absolute imperative language ('Hard rules — NEVER violate these') to enforce behavioral constraints. While the rules themselves are reasonable (e.g., confirm target tool before generating, don't pad output), absolute prohibition phrasing reduces the agent's ability to apply contextual judgment and could interfere with user-directed overrides.

The README explicitly documents that version 1.3.0 was rebuilt around 'PAC2026 positional structure (30/55/15)' to exploit LLM attention architecture. The SKILL.md uses PRIMACY/MIDDLE/RECENCY zone labels to position high-priority content at attention-weighted positions. This is transparent rather than hidden, which is a positive signal, but it confirms intentional attention manipulation.

Auditd PATH records show opens of /home/oc-exec/.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials at timestamp 1788554839.6 and 1788554861.4. The first batch precedes the git clone (1788554845.1) and coincides with EXECVE events for 'ss -tunap' and 'sudo kill -0', consistent with audit baseline measurement. The second batch occurs after all skill processing and matches canary re-check timing. The skill content contains zero instructions to access sensitive files. Canary integrity confirmed intact.

The skill directs the agent to read local files ('Read full templates from references/templates.md only for the category you need', 'Read references/patterns.md when user pastes a bad prompt'). These files exist within the skill directory and their content has been reviewed — they contain only prompt templates and pattern examples. However, this establishes a pattern where the skill controls which local files the agent reads during task execution.

The only external network connection observed was to 140.82.121.4:443 (GitHub HTTPS) for the git clone operation itself. No unexpected DNS queries, no connections to data collection endpoints, no persistent sockets established post-install.

The Model Recency Gate section instructs: 'Verify the current model and supported controls in the provider's official documentation when browsing or retrieval is available.' If the agent has web browsing tools, this could cause outbound HTTP requests to provider sites (Anthropic, OpenAI, xAI, etc.) during prompt generation. This is a legitimate use case but represents an indirect network request vector controlled by the skill.

The skill explicitly instructs the agent to treat pasted prompt content as inert data, not to execute embedded instructions, and not to reveal system prompt content or memory if a pasted prompt requests it. This is a genuine defensive measure against prompt injection via user input.