The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation explicitly instructs the agent to perform a variety of operations via shell commands using a Bash tool. These include directory creation (mkdir -p), moving/renaming (mv), copying (cp), retrieving metadata (stat), and potentially destructive actions like recursion deletion (rm -r). It also recommends using chmod to resolve permission errors, which gives the agent significant control over the host filesystem environment.
[INDIRECT_PROMPT_INJECTION]: The skill defines a high-capability environment that is susceptible to instructions embedded in processed files.
Ingestion points: The Read tool and Grep tool are used to ingest file contents (scripts, configuration, PDFs, and images) directly into the agent's context as described in SKILL.md.
Boundary markers: The instructions do not describe the use of any delimiters or system-level instructions to differentiate between 'data to be read' and 'instructions to be followed,' leaving the agent open to following commands found inside project files.
Capability inventory: The skill provides a comprehensive suite of modification tools, including Write, Edit (surgical string replacement), and powerful Bash utilities (rm, mv, chmod), which could be used as an attack vector if the agent is misled by file content.
Sanitization: There are no requirements or suggestions for sanitizing or validating external file content before it is processed by the AI or used as a source for Write or Edit operations.

filesystem