The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using bun or npx to run the main extraction script and invokes external utilities for asar extraction and code formatting.
[EXTERNAL_DOWNLOADS]: The script dynamically downloads and executes well-known packages @electron/asar and prettier from the npm registry using npx -y.
[PROMPT_INJECTION]: The skill processes external, potentially untrusted application code and source maps, which represents an indirect prompt injection surface.
Ingestion points: Reads .asar bundles and .js.map files from local application directories (scripts/main.ts).
Boundary markers: No specific delimiters are added to the extracted content.
Capability inventory: Includes file system write access and subprocess execution via npx.
Sanitization: Employs path normalization and validation logic (isSafeRelativePath, restoredTargetPath) to mitigate directory traversal risks.
[SAFE]: The skill includes security-focused logic such as assertSafeOutputDir to prevent overwriting critical system directories and validates that the output path is related to the application being processed.

baoyu-electron-extract