The Agent Skills Directory

[SAFE]: The skill implements robust privacy rules and safety gates that explicitly forbid the manual deletion of critical system servicing directories such as WinSxS and Windows Installer, while requiring the use of neutral placeholders in templates to prevent the exposure of personal file paths.
[COMMAND_EXECUTION]: The runbook utilizes standard administrative diagnostic tools (e.g., DISM, powercfg) and package managers (winget, scoop) to analyze system state, which is appropriate for its stated purpose of storage governance and follows a staged verification process.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied device profiles and filesystem metadata, creating a surface for potential instruction injection.
Ingestion points: Device profile templates in references/device-profile-template.md and user-provided path descriptions.
Boundary markers: The workflow mandates a clear distinction between template-only and local-audit scopes, supported by explicit privacy boundaries in the documentation.
Capability inventory: The skill uses diagnostic PowerShell commands and provides guidance on environment variable and registry-based configuration.
Sanitization: A strict risk classification model (Safe Clean, Official-Tool Clean, Do-Not-Touch) and a staged execution workflow (Observe, Classify, Verify, Rollback) serve as mitigations against untrusted data inputs.

win11-storage-governance