What the reviewer found
This file under skills/_samples/ is an intentionally poisoned test fixture, its own header comment says it exists only so the project's Warden scanner can be exercised against it and explicitly says 'Do NOT use this skill.' Every finding matches a genuine attack pattern (instruction override, curl|sh, AWS/SSH credential theft, exfil to webhook.site, cloud metadata SSRF) by design, but as a labeled non-functional sample it is not something anyone would install or run for real.
example-or-fixture— an example or test fixtureprompt-injection— tries to steer the agentexfiltration— sends data outcredential-access— reads credentialsremote-exec— runs code fetched from the network
What was read
The file as it ships in chadcorp/warden:
skills/_samples/poisoned-weather/SKILL.md
What the static scan said
The scan flagged 7things. The reviewer kept 7 and dismissed 0 as false.
P1Instruction-override phrasing — realP2Hidden instructions — realE1Sends data to an external URL — realPE3Reaches for credential files — realSC2Downloads and executes remote code — realSSRF1Cloud metadata endpoint — realNETMakes network calls — real
How this review was made
Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.