The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/filex.py uses subprocess.run to call the filex binary. The command is constructed as a list, which effectively prevents shell command injection.
[EXTERNAL_DOWNLOADS]: The skill allows the agent to trigger downloads from arbitrary HTTP(S) URLs via the --url argument. While the documentation mentions default size and timeout limits, this functionality allows the ingestion of untrusted remote content.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to process untrusted data from files and URLs, creating an attack surface for indirect prompt injection.
Ingestion points: Files are ingested via the --input and --url flags in scripts/filex.py.
Boundary markers: The skill documentation advises the agent to "Inspect the generated Markdown before claiming... fidelity," but the wrapper script does not implement technical delimiters or safety warnings around the tool's output.
Capability inventory: The script has capabilities to execute the filex binary (subprocess.run), create directories (Path.mkdir), and copy files within the workspace (shutil.copy2).
Sanitization: The script implements _inside_workspace which uses pathlib.Path.resolve() and relative_to() to validate that all file operations are confined to the designated sandbox workspace, preventing path traversal attacks.

filex