The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses platform-specific commands to open files: xdg-open (Linux), open (macOS), and start (Windows). These are executed via the shell using the resolved file path.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through its path inference mechanism. It automatically picks the latest unambiguous local file path from context if no explicit path is provided. An attacker or malicious tool could output a sensitive file path to trick the agent into opening it when the user provides a vague command like open it. Ingestion points: Conversation context and previous tool outputs in SKILL.md. Boundary markers: Absent; the skill relies on recency and ambiguity checks but does not use specific delimiters to isolate file paths from potentially malicious context. Capability inventory: Execution of system commands xdg-open, open, start via SKILL.md. Sanitization: The skill verifies the file exists and resolves relative paths without using shell eval, which mitigates direct command injection but does not prevent the opening of unintended files.

of