The Agent Skills Directory

[DATA_EXFILTRATION]: The skill provides instructions and shell command templates to read sensitive configuration and instruction files across multiple AI tools. These paths include ~/.cursor/skills, ~/.claude/skills, ~/.agents/skills, and tool-specific configuration files like ~/.aider.conf.yml. Accessing these files allows the agent to expose the logic, constraints, and potentially sensitive settings (in the case of config files) that define the behavior of other AI agents.
[COMMAND_EXECUTION]: The skill explicitly defines a wide range of shell commands for the agent to execute on the local filesystem, including ls, cat, mkdir, mv, cp, rm, find, and grep. These are targeted at hidden application directories in the user's home folder, enabling full lifecycle management (creation through deletion) of agent configuration files.
[PROMPT_INJECTION]: The skill facilitates an attack surface for indirect prompt injection by enabling the agent to overwrite or create new instruction files for other tools. A malicious actor could potentially use this skill to inject persistent, behavior-altering instructions into other AI applications the user relies on.
Ingestion points: File read operations using cat and grep on directories like ~/.cursor/skills/ and ~/.claude/skills/ (SKILL.md).
Boundary markers: Absent. There are no instructions provided to distinguish between valid skill content and embedded malicious instructions.
Capability inventory: The skill provides full file system manipulation capabilities (read, write, move, delete) via shell templates in SKILL.md targeting multiple tool-specific instruction paths.
Sanitization: Absent. The skill does not provide mechanisms to validate or sanitize the content of the skills being created or moved.

manage-skills