The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/score_stations.py implements a classification stage that uses subprocess.run with shell=True to execute a command string provided via the --classifier-cmd CLI argument. This allows for arbitrary shell command execution if the agent is manipulated into passing a malicious string as the classifier command.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process chat transcripts from various external and local sources (e.g., ~/.claude/projects/*.jsonl). Since these transcripts contain untrusted data from previous conversations, they represent an indirect prompt injection surface. The skill uses this data to automatically generate new executable skills, creating a path for malicious instructions embedded in chat history to influence future agent behavior.
Ingestion points: Processes .jsonl, .md, and .txt files from local directories such as ~/.claude/projects/ and ~/.codex/sessions/ (see transcript-quellen.md).
Boundary markers: No automated delimiters or sanitization logic is implemented in the provided Python scripts to isolate untrusted transcript content during processing.
Capability inventory: The skill is capable of writing new skill files (SKILL.md), creating shell command wrappers (~/.claude/commands/), and executing local scripts.
Sanitization: While manual guidelines are provided in neutralisierung.md, there is no programmatic sanitization to prevent malicious prompts in the input data from being interpreted as instructions by the agent during extraction.
[DATA_EXFILTRATION]: The skill instructions and metadata in transcript-quellen.md specifically target the extraction of data from local session directories and agent-specific project folders. While intended for its core purpose, this grants the agent broad access to historical conversation data which may contain sensitive information, and the score_stations.py script provides a mechanism to pass this data to an external classifier command.
[EXTERNAL_DOWNLOADS]: The skill documentation refers to several external components not included in the package, such as skill_sync.py and the skill-creator plugin, which introduces a dependency on external code that may be fetched or executed at runtime.

skill-extractor