The Agent Skills Directory

[SAFE]: The skill is a localized utility for organizing document trees via copy operations. It does not perform network operations, request elevated privileges, or implement persistence mechanisms.
[DATA_EXPOSURE]: The included scripts (scripts/housekeep-files.ps1 and scripts/housekeep-files.sh) contain a security filter that identifies sensitive file types, such as .env, .pem, .p12, and various key formats, using a regular expression. The logic ensures these files are only indexed in place rather than copied, mitigating the risk of credential proliferation.
[INDIRECT_PROMPT_INJECTION]: The skill processes file system metadata (filenames and directory structures), which is an inherent surface for indirect prompt injection. The implementation successfully mitigates this risk through defensive programming.
Ingestion points: Local filenames and directory paths are read during the inventory phase.
Boundary markers: The scripts utilize literal paths for all file operations and unit separators (ASCII 31) during plan parsing to prevent command injection via malicious filenames.
Capability inventory: The skill is restricted to file system read, copy, and SHA-256 hashing operations.
Sanitization: All catalog entries are JSON-escaped before being written to the manifest file, ensuring that special characters in filenames are handled safely.

housekeep-files