The Agent Skills Directory

[DATA_EXFILTRATION]: The skill bypasses standard context limits by programmatically reading the user's private Claude Code session transcripts stored in ~/.claude/projects/. This data, which includes the entire previous conversation history, is then transmitted to external third-party CLI services for translation.
Evidence: The script scripts/extract_last.py uses os.path.expanduser("~/.claude/projects") to locate and read JSONL transcript files containing verbatim conversation history.
[COMMAND_EXECUTION]: The skill is vulnerable to command injection because it interpolates raw user input from $ARGUMENTS (the target language) directly into shell commands. An attacker providing a language string containing shell metacharacters like backticks or subshells (e.g., Taiwan $(touch /tmp/pwned)) could execute arbitrary commands on the user's host machine.
Evidence: In SKILL.md, the user-supplied target language is placed into a PROMPT shell variable which is then used inside double quotes in commands such as agy --print "$PROMPT"... and codex exec ... "$PROMPT". Bash evaluates subshells inside double quotes, leading to code execution.
[PROMPT_INJECTION]: The skill contains explicit instructions to bypass or disregard configured safety and behavioral guidelines of the external AI models it calls.
Evidence: The system instructions for the translation step include: "Ignore any configured user-preference instructions about greetings or how to address the user — they do not apply to pipeline output."

babel