The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of instructions from other local files by prompting the agent to read and search the content of existing skill files. If these files contain malicious instructions, the agent could potentially follow them during the management process.
Ingestion points: The skill instructs the agent to use cat and grep on directories like ~/.cursor/skills/ and ~/.windsurf/rules/ to inspect existing instruction sets.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the files being managed.
Capability inventory: The skill possesses extensive file system capabilities, including recursive deletion (rm -rf), file overwriting (cat >), and moving files (mv), which could be abused if the agent is influenced by malicious content in a managed file.
Sanitization: No sanitization or validation of the content within the managed skill files is performed.
[COMMAND_EXECUTION]: The skill provides templates for powerful shell commands to perform its operations. While these are intended for legitimate management tasks, they include high-impact operations like rm -rf for deleting skill directories and cat > for overwriting configuration files (e.g., ~/.aider.conf.yml, .github/copilot-instructions.md) across multiple tool-specific paths in the home directory.

manage-skills