The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's analysis phase involves commands that can expose sensitive file paths to the model context.
Instructions in SKILL.md suggest using ls -la on user-specified directories, which can include sensitive paths such as ~/.ssh, ~/.aws, and .env files.
While the skill does not contain logic to exfiltrate this data over a network, the exposure of these paths to the model represents a data exposure risk according to internal security standards.
[COMMAND_EXECUTION]: The skill uses powerful shell commands to inspect and modify the local filesystem.
It utilizes mv, mkdir, find, and du to reorganize files and create directory structures.
It employs md5 hashing to identify duplicate files, which requires reading the contents of files within the target directories.
The skill includes safety instructions requiring the agent to seek explicit user confirmation before deleting duplicates or executing a proposed organization plan.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from the filesystem, creating a surface for indirect prompt injection.
Ingestion points: The skill reads directory contents, filenames, and file types using ls and find commands in SKILL.md (Step 2 and 4).
Boundary markers: There are no specific delimiters or instructions to prevent the model from interpreting content within filenames as instructions.
Capability inventory: The agent has the capability to move (mv), rename, and delete (rm) files as specified in SKILL.md.
Sanitization: The instructions do not define any sanitization or validation processes for filenames or paths before they are processed by the agent.

file-organizer