The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/main.ts script utilizes child_process.spawn and spawnSync to execute npx commands. These invocations are used to run the @electron/asar extraction tool and the prettier code formatter for processing application resources.
[EXTERNAL_DOWNLOADS]: The skill uses npx to dynamically fetch and execute the @electron/asar and prettier packages from the public npm registry (npmjs.com) during runtime. These are well-known and trusted developer tools.
[DYNAMIC_EXECUTION]: The script performs dynamic execution by spawning external processes to handle archive extraction and source code formatting based on the target application.
[INDIRECT_PROMPT_INJECTION]: By decompiling and extracting source code from third-party Electron applications, the skill processes untrusted external data which could potentially contain malicious instructions if the extracted content is later analyzed by an LLM.
Ingestion points: The scripts/main.ts script reads and extracts content from user-provided .asar archives and .js.map files.
Boundary markers: None; extracted files are written directly to the filesystem.
Capability inventory: The script has permissions for filesystem writes and command execution.
Sanitization: The implementation includes dedicated path normalization logic (normalizeSourcePath) and output directory validation (assertSafeOutputDir) to mitigate directory traversal risks and ensure files are only written to safe, user-specified locations.

baoyu-electron-extract