The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python script (scripts/contacts.py) to manage contacts. The script uses the standard argparse library to handle user input securely and does not perform any dangerous system calls or shell executions.
[DATA_EXFILTRATION]: The skill stores all data locally in ~/.claude/skills/contacts/contacts.json. There are no network requests (e.g., curl, requests) or any functionality to transmit data to external servers.
[EXTERNAL_DOWNLOADS]: The requirements.txt file indicates that no external dependencies are required. The installation process involves cloning the repository or copying files manually, with no automated downloads of remote scripts or binaries.
[PRIVILEGE_ESCALATION]: The installation instructions include a chmod +x command to make the local script executable. This is a standard and expected operation for local script development and does not constitute a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data (contact names, phone numbers, emails, and profiles). However, the skill lacks high-risk capabilities like network access or shell execution, significantly limiting the potential impact of any injected instructions in the processed data.

contacts