The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (python3 -m scripts <absolute_filepath>) where the file path is a variable provided by the user. If the agent does not properly sanitize or quote this variable, it could lead to command injection if a malicious filename is processed.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. It reads untrusted content from user-specified files and interpolates it directly into a prompt template sent to the claude command line tool.
Ingestion points: The content of the target file is read in scripts/compress.py using the filepath.read_text() method.
Boundary markers: The skill uses XML-style tags (<TEXT>, <ORIGINAL>, and <COMPRESSED>) to delimit untrusted content. These markers can be easily bypassed if the input file contains the corresponding closing tag (e.g., </TEXT>).
Capability inventory: The skill has the ability to read and write files (overwriting original project files like CLAUDE.md) and execute subprocesses via subprocess.run to call the claude CLI.
Sanitization: There is no evidence of escaping, filtering, or validation of the file content before it is interpolated into the prompt templates in scripts/compress.py.

eli5-compress