The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-controlled filesystem metadata, such as file and directory names, and passes them to the AI agent to generate human-readable explanations in a report. This presents a surface where a maliciously named file could attempt to influence the agent's reasoning.
Ingestion points: scripts/storage_scan.py and scripts/carl_file_organizer/scanner.py scan names and paths from the local disk.
Boundary markers: Absent; filenames are processed directly for descriptive reasoning.
Capability inventory: scripts/carl_file_organizer/executor.py and scripts/carl_file_organizer/dispose.py can perform destructive actions like moving, trashing, or deleting files.
Sanitization: The tool mitigates this risk by separating AI commentary from actual security decisions. File classification (e.g., determining if a file is in a 'Red' no-go zone) is handled by static Python rules, and the agent's notes cannot override the action permissions or execution state. UI outputs are HTML-escaped to prevent script injection.
[COMMAND_EXECUTION]: The skill executes various system utilities to gather diagnostics and perform maintenance tasks.
System utilities: gathering data via df, sw_vers, sysctl, uname, uptime, memory_pressure, and vm_stat.
Safety verification: gathered using lsof to check for active file locks before operations.
Maintenance: using osascript (for trashing on macOS), xattr (for Finder tags), and standard shutil library functions.
Safety implementation: All commands are invoked as hardcoded argument lists via subprocess.run or Popen without using a shell environment, preventing command injection.

carl-file-organizer