The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exposes local file reading and directory listing capabilities which constitute an attack surface for indirect prompt injection if the agent processes files containing untrusted or adversarial instructions.\n
Ingestion points: The read_file.md sub-skill allows the agent to ingest complete file contents, while list_directory.md and search_files.md ingest file names and directory structures into the agent context.\n
Boundary markers: The skill instructions do not define specific delimiters or instructions to treat data read from the filesystem as untrusted content.\n
Capability inventory: The skill includes high-impact capabilities like write_file.md (file modification) and move_file.md (file relocation/renaming) which could be misused if the agent is influenced by malicious content in a read file.\n
Sanitization: No explicit sanitization, validation, or escaping rules are provided for the content read from files or the paths used in operations.

filesystem-mcp