The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local Python scripts to perform registry updates and skill packaging. Specifically, install_skill.py uses subprocess.run to call an internal registry scanner (scan_registry.py). While these paths are internally constructed and use hardcoded root directories, the reliance on shell execution is a high-privilege operation.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion pipeline for third-party SKILL.md files found in potentially untrusted locations like Downloads or Temp directories. Maliciously crafted metadata or instructions in these files could attempt to influence the agent's behavior during the installation or management process.
Ingestion points: detect_skills.py and install_skill.py scan and parse SKILL.md files from various user-controlled directories.
Boundary markers: The skill uses standard YAML delimiters for parsing but lacks specific instructions to the agent to disregard potentially malicious instructions within the skill body.
Capability inventory: The installer possesses powerful capabilities including file deletion (shutil.rmtree), file moves (shutil.move), and script execution (subprocess.run).
Sanitization: The skill implements robust path validation using Path.relative_to and safe_user_path to prevent path traversal attacks, and includes a proactive check to block the installation of sensitive files (e.g., .env, *.key) via validate_skill.py.
[DATA_EXFILTRATION]: detect_skills.py performs recursive scans of broad user directories, including Desktop, Downloads, and Documents, to identify potential skills. When run with the --all flag, it extends this scan to projects and repositories. While no external network exfiltration was detected, the broad discovery of local file structures provides an extensive data-gathering surface for the agent.

skill-installer