The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-specified files and interpolates their text into prompts for LLM compression. This creates a surface where malicious content within a file could attempt to manipulate the compression output or process. * Ingestion points: scripts/compress.py reads file content using read_source. * Boundary markers: The skill masks code blocks, HTML comments, and  regions using mask_code_blocks to protect them from LLM modification. It also separates YAML frontmatter before processing. * Capability inventory: Performs atomic file writes (os.replace) and executes CLI tools via subprocess.run. * Sanitization: Implements structural validation in scripts/validate.py to ensure headings, code blocks, URLs, and file paths are preserved exactly.
[COMMAND_EXECUTION]: The skill uses subprocess.run to invoke the claude and opencode CLI tools for compression. These calls are implemented with fixed argument lists and no shell interpolation to mitigate injection risks.
[DATA_EXFILTRATION]: As part of its intended function, the skill transmits file content to configured LLM providers. It mitigates accidental exfiltration through heuristic checks: is_sensitive_path prevents reading files like .env or ~/.ssh/ and find_credential uses regex patterns to detect and block files containing common API keys or private tokens.

caveman-compress