The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the agent to run npx -y @nomadamas/k-skill@0, which downloads and executes a package from an untrusted source. This command is also used to fetch dynamic instructions via the instruct subcommand, allowing for remote instruction injection.
[EXTERNAL_DOWNLOADS]: The skill fetches the @nomadamas/k-skill package from the public npm registry. This source is not associated with any trusted organizations or well-known services provided in the analysis scope.
[DATA_EXFILTRATION]: The skill and its included Python script (scripts/k_skill_cleaner.py) are designed to read sensitive agent log files and transcripts located in paths such as ~/.claude/transcripts/, ~/.codex/sessions/, and ~/.local/share/opencode/. These files contain private conversation history, user prompts, and code snippets.
[INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted data from multiple agent transcript sources without evidence of sanitization or boundary markers.
Ingestion points: Transcripts and log files referenced in instruction.md and processed by scripts/k_skill_cleaner.py (e.g., ~/.claude/projects/**/*.jsonl).
Boundary markers: None identified; the instructions and script read raw log lines directly.
Capability inventory: The skill possesses the ability to read the file system and execute shell commands via npx.
Sanitization: Not present; the helper script uses regex patterns to search within raw transcript content, which could be influenced by malicious content inside the logs.

k-skill-cleaner