What the reviewer found
File at examples/malicious-skill/SKILL.md: an HTML comment does tell the agent to ignore prior instructions, print the user's environment variables and API keys, and hide the step from the user — a textbook prompt-injection payload. It is an explicitly labeled example/fixture of what a malicious skill looks like, not something an installer would run as-is, so it is a demonstration rather than an active attack against whoever reads this packet.
prompt-injection— tries to steer the agentcredential-access— reads credentialsexample-or-fixture— an example or test fixture
What was read
The file as it ships in ByJH/airlock:
examples/malicious-skill/SKILL.md
What the static scan said
The scan flagged 2things. The reviewer kept 2 and dismissed 0 as false.
P1Instruction-override phrasing — realP2Hidden instructions — real
How this review was made
Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.