The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses the Python pickle module to load cached index data from the local file system at /home/claude/.bm25-cache/. Because pickle.load() can execute arbitrary code during deserialization, this represents a significant security risk if the local cache directory is accessible to other processes or skills that might place a malicious file there.
[COMMAND_EXECUTION]: In scripts/bm25.py, the tarfile.extractall() method is used to extract repository archives downloaded from GitHub. The skill does not validate the paths of files within these archives, making it vulnerable to path traversal (TarSlip). A malicious archive could overwrite system files or place files in sensitive locations like .bashrc to gain control over the environment.
[EXTERNAL_DOWNLOADS]: The skill fetches repository tarballs from the GitHub API (api.github.com) using urllib.request.urlopen. While this is a documented feature for indexing remote repositories, the lack of validation during extraction (see above) makes this download path risky.
[PROMPT_INJECTION]: The skill indexes and returns snippets from arbitrary text files in the corpus, creating a surface for indirect prompt injection where malicious instructions in the documents could influence the agent's behavior.
Ingestion points: The discover_files function in scripts/bm25.py reads content from all files matching the text allowlist in a given directory or repository.
Boundary markers: None. Snippets are printed directly to the output without delimiters or warnings for the agent to ignore embedded instructions.
Capability inventory: The skill has the ability to read and write to the file system, download data from the network, and extract archives.
Sanitization: No content sanitization or instruction filtering is implemented.

bm25