The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/compress.py executes a local binary named claude using subprocess.run. This is implemented as a fallback mechanism to perform compression if the anthropic Python library is not installed. The command is invoked without a shell and receives input via standard input, which reduces the risk of shell injection.
[DATA_EXFILTRATION]: This skill transmits the content of user-specified files to Anthropic's external API for processing. To mitigate the risk of leaking secrets, the skill implements a heuristic blacklist in scripts/compress.py (is_sensitive_path) that blocks files matching patterns for SSH keys, environment variables (.env), and common credential filenames (e.g., credentials, secrets).
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads external file content and interpolates it directly into an LLM prompt in scripts/compress.py (build_compress_prompt). A malicious file could contain instructions designed to influence the compression logic or the behavior of the agent.
Ingestion points: The skill reads local files provided by the user via the command-line argument in scripts/cli.py and scripts/compress.py.
Boundary markers: The prompts use natural language headers (e.g., テキスト:) to delineate the injected content, but they do not use unique or randomized delimiters to isolate the file data from the system instructions.
Capability inventory: The skill possesses the capability to write to the local file system (overwriting the original file after creating a backup) and perform network requests to the Anthropic API.
Sanitization: The skill performs basic post-processing in strip_llm_wrapper to remove markdown code fences from the LLM's response before writing it back to the file system.

genshijin-compress