Files

vitya 9f54068de0 feat: migrate 12 personal skills + add build/install scripts

- skills/: editable sources for all 12 personal skills (caveman family,
  find-skills, project-bootstrap, task-status-wiki, using-context7,
  using-markitdown, wiki-maintainer, compress)
- dist/: built .skill archives, committed (cross-machine deploy without
  needing zip on the target)
- scripts/build.sh + build.ps1: zip skills/<name>/ into dist/<name>.skill;
  Windows fallback uses .NET ZipArchive (PS 5.1 Compress-Archive writes
  backslashes that break extraction on *nix)
- scripts/install.sh: copy skills/<name>/ into ~/.claude/skills/<name>/
  ($CLAUDE_SKILLS_DIR overrides target)
- .wiki/source/repo-layout.md, build-notes.md: design + gotchas
- .gitignore: keep dist/ tracked

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-28 10:42:33 +03:00

1.5 KiB

Raw Blame History

Security

Snyk High Risk Rating

caveman-compress receives a Snyk High Risk rating due to static analysis heuristics. This document explains what the skill does and does not do.

What triggers the rating

subprocess usage: The skill calls the claude CLI via subprocess.run() as a fallback when ANTHROPIC_API_KEY is not set. The subprocess call uses a fixed argument list — no shell interpolation occurs. User file content is passed via stdin, not as a shell argument.
File read/write: The skill reads the file the user explicitly points it at, compresses it, and writes the result back to the same path. A .original.md backup is saved alongside it. No files outside the user-specified path are read or written.

What the skill does NOT do

Does not execute user file content as code
Does not make network requests except to Anthropic's API (via SDK or CLI)
Does not access files outside the path the user provides
Does not use shell=True or string interpolation in subprocess calls
Does not collect or transmit any data beyond the file being compressed

Auth behavior

If ANTHROPIC_API_KEY is set, the skill uses the Anthropic Python SDK directly (no subprocess). If not set, it falls back to the claude CLI, which uses the user's existing Claude desktop authentication.

File size limit

Files larger than 500KB are rejected before any API call is made.

Reporting a vulnerability

If you believe you've found a genuine security issue, please open a GitHub issue with the label security.

1.5 KiB Raw Blame History