The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/resolve.py file uses tarfile.extractall() and zipfile.extractall() to extract contents from GitHub repository downloads and user-provided archives without safety filters. This makes the skill vulnerable to path traversal attacks (TarSlip/ZipSlip) where a malicious archive could overwrite or access sensitive files outside the designated workspace. \n- [COMMAND_EXECUTION]: The skill frequently invokes subprocess.run to execute external binaries, including ripgrep for regex search and Python package managers (pip and uv) for runtime environment modification. \n- [EXTERNAL_DOWNLOADS]: The skill automatically fetches repository archives from codeload.github.com and installs third-party Python packages (scikit-learn, tree-sitter) from public registries at runtime when specific search modes are activated. \n- [DYNAMIC_EXECUTION]: The skill's AST expansion and Python reference features involve the dynamic loading of compiled grammar libraries via ctypes and the runtime installation of binary dependencies. \n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code from external repositories or archives and returns it to the agent as search results. The lack of explicit boundary markers or sanitization for these results creates a surface for indirect prompt injection. \n- [METADATA_POISONING]: The SKILL.md and CHANGELOG.md documentation contains anomalous future-dated benchmarks (dated 2026) and citations for future arXiv papers, which appears to be deceptive content intended to bolster the tool's authority.

searching-codebases