The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads local file content and transmits it to an external service (Anthropic API or the claude CLI) for processing. This is a core function of the skill but constitutes a data boundary crossing.
[COMMAND_EXECUTION]: The script scripts/compress.py executes the claude CLI tool using subprocess.run. Although it uses a safe argument list that prevents shell command injection, it depends on the presence and secure configuration of an external system binary.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the way it processes external data.
Ingestion points: Untrusted content is read from local files in scripts/compress.py via filepath.read_text().
Boundary markers: The LLM prompts constructed in build_compress_prompt and build_fix_prompt do not use robust delimiters or specific instructions to ignore malicious directives embedded within the input text.
Capability inventory: The skill possesses file-writing capabilities (filepath.write_text()), allowing it to modify the local filesystem based on LLM output.
Sanitization: Input text is not sanitized before interpolation into prompts, and while scripts/validate.py checks for structural integrity (headings, code blocks, URLs), it does not inspect the output for injection payloads.
[DATA_EXPOSURE]: The skill implements a security blocklist in scripts/compress.py (is_sensitive_path) which proactively identifies and rejects files based on sensitive names (e.g., .env, id_rsa) or directory paths (e.g., .ssh, .aws, .kube) to mitigate accidental data exposure.

genshijin-compress