The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/publish.py utilizes subprocess.run to execute standard git and gh (GitHub CLI) com mands for repository operations such as cloning, branching, and creating Pul l Requests on the mphinance/alpha-skills repository.
[DATA_EXFILTRATION]: The scripts/mine_chats.py script performs read s on Claude Code chat transcripts located in ~/.claude/projects/ to extract usage signals. While this involves sensitive data access, it is the primary stated purpose of the skill's audit mode and the data is processed locally.
[EXTERNAL_DOWNLOADS]: The skill clones the mphinance/alpha-skills repository from GitHub into a local cache directory to stage changes for forged or refined skills.
[PROMPT_INJECTION]: The ingestion of local chat logs by scripts/mine_chats.py introduces a surface area for indirect prompt injection from previous session data. * Ingestion points: Reads ~/.claude/projects/**/*.jsonl in scripts/mine_chats.py. * Boundary markers: No explicit delimiters or warnings used when processing log text. * Capability inventory: File writing and com mand execution capabilities are available via scripts/publish.py. * Sanitization: Em ploys basic regex-based filtering but lacks instruction-aware sanitization.

skill-forge