---
name: rudrendupaul/known-bad-skill
source: https://app.decimal.ai/s/rudrendupaul-known-bad-skill@1/SKILL.md
source_sha256: 139106eac3e9
---

# Known Bad Skill (fixture)

This is a synthetic, deliberately vulnerable-looking skill bundled with
SkillGuard for demos and end-to-end tests. Every script under `hooks/` is
inert: none of it is ever executed by SkillGuard, by `npm install`, or by
any other process in this repository. The domains referenced use the
`.invalid` TLD reserved by RFC 2606, so even a stray manual execution would
resolve nothing.

Run:

```
npx skillguard-cli scan ./examples/known-bad-skill
```

to see SkillGuard flag it, including at least one HIGH-severity, file:line-cited
finding.