The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local system commands using Python's subprocess module to perform its primary functions. This includes disk usage scanning (e.g., du on macOS), system identification (e.g., sw_vers, uname), and file management tasks like moving items to the trash via osascript or opening file explorer windows with open and explorer.
[INDIRECT_PROMPT_INJECTION]: The skill's analysis phase involves the agent interpreting file system metadata, specifically file and directory names. Since these names are outside the skill's control, they represent a potential surface for indirect prompt injection if an attacker crafts malicious names designed to influence the agent's classification logic. * Ingestion points: File names and paths are collected by scripts/scan.py and provided to the agent in JSON format. * Boundary markers: The agent processes the JSON data without specific delimiters to isolate file names from operational instructions. * Capability inventory: The skill possesses capabilities for file deletion and system interaction through scripts/server.py. * Sanitization: The skill does not perform sanitization on the file system strings before they are processed by the agent.
[DYNAMIC_EXECUTION]: The skill employs a dynamic interaction model where it generates an interactive HTML report that communicates with a temporary local HTTP server (scripts/server.py). This server provides an API for file system operations triggered by user actions in the report. Security controls are implemented, including binding the server to 127.0.0.1, utilizing a random session token for authentication, and strictly whitelisting allowed file paths to the user's home directory.

storage-analyzer