The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/main.ts file uses child_process.spawn and spawnSync to execute shell commands. Specifically, it invokes npx to run utility packages for ASAR extraction and code formatting.
[EXTERNAL_DOWNLOADS]: The skill relies on npx to download and execute external packages @electron/asar and prettier from the npm registry at runtime if they are not already cached.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, which presents an indirect prompt injection surface.
Ingestion points: The scripts/main.ts script reads user-provided .asar files and parses the content of embedded .js.map files.
Boundary markers: No explicit boundary markers or instructions are used to separate untrusted data from agent instructions during processing.
Capability inventory: The skill has the capability to write files to the local system (writeFileSync, mkdirSync) and execute commands via spawn.
Sanitization: The script implements path sanitization in normalizeSourcePath and isSafeRelativePath to ensure that restored source files do not use malicious relative paths (e.g., ../../../) to escape the designated restored/ output directory.

baoyu-electron-extract