The Agent Skills Directory

[PROMPT_INJECTION]: The read command outputs raw file content without wrapping or boundary markers, creating a surface for Indirect Prompt Injection.
Ingestion points: The cmd_read function in scripts/manage-files.py reads and prints file content directly.
Boundary markers: Absent; output is raw as explicitly stated in SKILL.md ("Raw file content (no wrapping)").
Capability inventory: The skill has capabilities for file mutation (write, remove, mkdir), filesystem discovery, and IDE launcher execution.
Sanitization: Absent; the script prints the file content verbatim to the agent's context.
[DATA_EXFILTRATION]: The discover command facilitates filesystem enumeration beyond the intended plan scope.
The command accepts an absolute --root directory for glob-based searches (discover_parser.add_argument('--root', ...)), enabling the agent to search for sensitive files (e.g., credentials or configuration) across the entire reachable filesystem.
[COMMAND_EXECUTION]: The open-in-ide subcommand invokes external binaries using system commands.
The script uses subprocess.run to launch IDE applications (VS Code, Cursor, PyCharm, etc.). While it avoids shell=True, it accepts an absolute --path argument that is passed directly to the launcher, which could be abused to interact with sensitive files or potentially trigger vulnerabilities in the IDE's CLI handling.

manage-files