The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill implements a caching mechanism in scripts/bm25.py that uses the pickle module to serialize and deserialize document paths and content. The use of pickle.load() is inherently unsafe as it can execute arbitrary code during deserialization. While the cache is stored in an ephemeral session directory (/home/claude/.bm25-cache/), the deterministic nature of the cache key (a SHA256 hash of the corpus path and filters) could allow for cache poisoning or pre-seeding attacks in environments with persistent or shared storage.
[EXTERNAL_DOWNLOADS]: The resolve_corpus function in scripts/bm25.py fetches tarballs from the GitHub API when a repository URL is provided. It extracts these tarballs using tarfile.extractall() without any safety filters or path validation. This pattern is vulnerable to path traversal attacks, where a maliciously crafted tarball could overwrite or create files outside the intended extraction directory.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary text from user-specified directories or external GitHub repositories, creating a vulnerability surface for indirect prompt injection.
Ingestion points: The discover_files function in scripts/bm25.py reads content from all files matching a text-extension allowlist within the target corpus.
Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded commands within the indexed text.
Capability inventory: The skill has capabilities to read/write files (Path.read_text, Path.write_text), perform network requests (urllib.request.urlopen), and perform unsafe deserialization (pickle.load) and extraction (tarfile.extractall) in scripts/bm25.py.
Sanitization: Absent. The skill performs no sanitization or filtering of the text content before indexing or rendering snippets.

bm25