The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation describes a 'hooks' feature in YAML profiles (e.g., on_start, on_complete, on_error, pre_transfer) that allows for the execution of arbitrary shell commands. This provides a direct path for executing external scripts or system commands as part of the file transfer workflow.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection (Category 8) through the on_file_complete hook template: /opt/scripts/index_media.sh {filename}.
Ingestion points: Filenames and paths processed during transfer operations (SKILL.md).
Boundary markers: None present in the provided templates to prevent shell metacharacter injection.
Capability inventory: The tool executes subprocesses and shell commands (e.g., fastcopy, notify-send, and custom scripts defined in hooks).
Sanitization: The examples do not demonstrate sanitization or escaping of the {filename} variable before it is interpolated into a shell command string.
[EXTERNAL_DOWNLOADS]: Installation instructions for macOS and Linux suggest downloading binaries from external URLs (example.com) using curl and wget, followed by execution or moving files to system paths with sudo. While the URLs provided are placeholders, the pattern encourages downloading and running unverified code from the internet.
[COMMAND_EXECUTION]: Several examples involve the use of sudo for installation, service management (systemctl), and troubleshooting (preserving file permissions), which requires elevated privileges.

fastcopy-file-transfer-utility