The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries such as the claude CLI and opencode using the subprocess module.
Evidence: scripts/compress.py calls subprocess.run within the run_cli function to interact with configured LLM providers.
Mitigations: The skill avoids using shell=True and passes arguments as a list, reducing the risk of command injection.
[DATA_EXFILTRATION]: The skill's primary function is to send the text of local files to external LLM providers (Anthropic, Opencode, or user-defined OpenAI-compatible endpoints).
Evidence: File contents are read in scripts/compress.py and transmitted via HTTP requests or CLI stdin.
Mitigations: A robust is_sensitive_path heuristic in scripts/compress.py blocks the compression of files that likely contain secrets, such as .env, .ssh/id_rsa, .aws/credentials, and files containing keywords like password or token.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data (local files) and interpolates it into prompts sent to an LLM.
Ingestion points: scripts/compress.py reads file content using read_source.
Boundary markers: The prompt in build_compress_prompt uses a TEXT: label but lacks strong delimiters.
Capability inventory: The skill has the ability to overwrite local files and perform network requests to LLM providers.
Sanitization: The skill implements mask_code_blocks to protect technical content from modification and a structural validate step in scripts/validate.py to ensure headings, code blocks, and URLs are not corrupted by the LLM response.

caveman-compress