skills/delorenj/skills/folder-curator/Gen Agent Trust Hub

folder-curator

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PERSISTENCE]: The skill provides detailed instructions and systemd user unit templates (curator-drain.service, sync-jim-dropbox.service, and associated timers) to establish persistent background processes for automated file curation and remote synchronization.
  • [COMMAND_EXECUTION]: The folder_curator.py script utilizes subprocess.run to invoke external binaries and CLI tools, including git for repository management, mc (MinIO Client) for S3 archival, pdf2md for document conversion, and bb-emit for NATS-based event notification.
  • [DYNAMIC_EXECUTION]: The skill includes a serve command that launches a ThreadingHTTPServer. This server exposes the engine's core logic (plan and apply) as an unauthenticated HTTP API on 127.0.0.1, enabling external services like n8n to trigger local file system operations.
  • [EXTERNAL_DOWNLOADS]: The Python scripts (folder_curator.py and curator-drain.py) leverage uv run with PEP 723 inline metadata to automatically fetch and install dependencies such as PyYAML and nats-py from the Python Package Index (PyPI) at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process files from external sources (e.g., Google Drive) where malicious content or frontmatter could influence agent classification and routing decisions.
  • Ingestion points: Incoming files in the watched directory, synchronized from external sources via rclone (documented in references/drive-sync.md).
  • Boundary markers: Utilizes standard YAML frontmatter delimiters (---) as seen in scripts/folder_curator.py to separate metadata from body content.
  • Capability inventory: Performs file moves, renames, and writes; archives content to S3 via mc; and emits events via bb-emit.
  • Sanitization: Employs slugify for destination names and yaml.safe_load for metadata parsing to mitigate some injection risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 06:55 AM
Security Audit — agent-trust-hub — folder-curator