The Agent Skills Directory

[DYNAMIC_EXECUTION]: The module scripts/yaml_runtime.py implements a custom MetaPathFinder and Loader that uses the compile() and exec() functions to load the bundled PyYAML library from the vendor/pyyaml/ directory. Although the loader verifies file hashes against vendor/pyyaml/manifest.json before execution, the use of exec on dynamically compiled source code is a high-risk pattern.
[COMMAND_EXECUTION]: The skill extensively uses subprocess.run and subprocess.Popen across multiple files including scripts/conformance.py, scripts/active_project.py, scripts/session_context.py, and scripts/project_context.py. These commands primarily interact with git and client binaries (Claude, Codex), often using paths derived from local project state.
[DATA_EXFALTRATION]: The skill audits sensitive configuration and transcript data from agent directories like ~/.claude and ~/.codex. While scripts/capability_evidence.py contains regex-based sanitization logic to prevent the recording of credentials (e.g., ghp_, sk-, AKIA), the skill's purpose involves processing and potentially reporting on the state of these sensitive files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including project transcripts (JSONL files) in scripts/live_receipt.py and project context files (CONTEXT.md, REFERENCE.md) in scripts/session_context.py.
Ingestion points: scripts/live_receipt.py (transcripts), scripts/project_context.py (project files).
Boundary markers: Uses Markdown headers and checklist patterns, but lacks rigorous delimiters to separate instructions from data.
Capability inventory: Possesses high-privilege capabilities including shell command execution (subprocess) and file system access.
Sanitization: Implements a custom memory-bounded JSON parser (_TranscriptJSON) to mitigate resource exhaustion during ingestion, but does not fully sanitize the contents against embedded instructions.

synthesis-agent-conformance