The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides instructions and templates for implementing local file system tools (e.g., renameFile) that interact with the host filesystem. This introduces an attack surface where an agent could be manipulated via untrusted data to perform unauthorized file operations.
Ingestion points: Data entering via the RenameLocalFileParams interface in src/store/chat/slices/builtinTool/actions/localFile.ts, specifically the oldPath and newName parameters.
Boundary markers: The provided code templates do not demonstrate the use of delimiters or specific instructions to ignore potential commands embedded within file names or paths.
Capability inventory: File system access via the fs.rename operation implemented within apps/desktop/src/main/controllers/LocalFileCtr.ts.
Sanitization: The implementation example in references/local-tools.md uses path.join but lacks validation or sanitization to prevent path traversal attacks or to restrict operations to safe directories.

desktop