The Agent Skills Directory

[COMMAND_EXECUTION]: The skill configuration explicitly allows the execute_command tool. This capability enables the agent to run arbitrary shell commands on the host system, which presents a significant security risk if the agent's logic is subverted.
[REMOTE_CODE_EXECUTION]: The workflow instructions direct the agent to use a specific helper script located at scripts/mp-downloader.py. This script is an external, unverifiable dependency as its source code is not included in the provided skill files.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where instructions embedded in external data could influence agent behavior.
Ingestion points: The agent reads potentially attacker-controlled data from the file system through the storage.list and media.recognize operations (e.g., malicious file or directory names).
Boundary markers: The instructions lack explicit delimiters or guidance to ignore natural language instructions that might be found within file names or metadata.
Capability inventory: The skill has powerful tools available, including shell command execution (execute_command), file system manipulation (transfer.file), and metadata modification (media.scrape).
Sanitization: The workflow includes a requirement for the agent to summarize planned actions and wait for user confirmation before performing state-changing transfers, which serves as a partial mitigation through human oversight.

organize-files