The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to execute mv commands on files within the ~/Downloads directory. This creates a risk of command injection if the agent does not properly escape filenames that contain shell metacharacters (e.g., semicolons, backticks).
[DATA_EXFILTRATION]: The skill accesses the ~/Downloads folder, which is a sensitive directory likely containing personal documents, installers, and potentially sensitive information. While no explicit network exfiltration is present in the script, the access to this data represents a significant privacy risk.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. Because it surveys and processes the contents of an untrusted directory (~/Downloads), an attacker could place a file with a malicious name or content designed to manipulate the agent's behavior, such as tricking it into moving files to an incorrect location or revealing information about other files.
Ingestion points: File names and metadata from the ~/Downloads folder processed in SKILL.md.
Boundary markers: None provided; the agent is not instructed to ignore instructions found within file metadata or names.
Capability inventory: The skill uses Bash (for moving files), Read, and Glob to interact with the file system.
Sanitization: No explicit sanitization or escaping of filenames is mentioned in the instructions before passing them to the shell.

clean-downloads