The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions designed to override the agent's standard safety behavior regarding destructive actions. The documentation states that it "avoids the usual per-command permission prompt" and explicitly claims that the "skill does NOT require user permission for deletion," which is an attempt to suppress platform-level safety guardrails.
[COMMAND_EXECUTION]: The skill instructs the agent to execute high-risk shell commands, including rm, rm -rf, and a specialized script ai-safe-rm. These instructions include patterns for deleting files and directories both inside and outside of a git repository.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface where untrusted data (like filenames or paths) could potentially influence the agent's behavior during a deletion task.
Ingestion points: Path arguments passed to the ai-safe-rm and rm commands within SKILL.md.
Boundary markers: None present; there are no delimiters or warnings to ignore instructions embedded in the filenames being processed.
Capability inventory: Destructive file operations including rm, rm -rf, and file moves (mv) used for the backup logic.
Sanitization: No input sanitization or validation is implemented; while a repository check is suggested, the skill provides a fallback to raw rm commands if the check fails, further increasing the risk.

safe-rm