The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell-based commands including Git operations and a local Bash script.
Evidence:
Invocation of scripts/scan-sensitive.sh to search for patterns across the filesystem.
Use of git filter-repo to rewrite repository history, which is a powerful and destructive operation.
Use of git push --force-with-lease which can overwrite remote branch history.
File management commands like readlink -f, diff -rq, and git rm --cached.
[DATA_EXFILTRATION]: The skill's primary function is to move data from local directories to remote repositories, creating a vector for data exfiltration.
Evidence:
Instructions to push local content from ~/.agents/skills/ to a user-defined personal_remote repository.
Explicit handling of config.local.yml, which is described as containing "personal emails, company paths" and other sensitive metadata.
Mentions using SSH host aliases to authenticate against GitHub, potentially utilizing local SSH keys.
[INDIRECT_PROMPT_INJECTION]: The skill processes external agent skills and Git history, which creates an attack surface for instructions embedded in untrusted data.
Evidence:
Ingestion points: Processes all files within ~/.agents/skills/, the contents of config.local.yml, and the full commit history of repositories during scans.
Boundary markers: Absent. The skill does not implement delimiters or specific instructions to ignore embedded prompts within the files it syncs.
Capability inventory: Possesses significant capabilities including filesystem read/write (cp, rm), remote network transmission (git push), and repository manipulation (git filter-repo).
Sanitization: While it uses scan-sensitive.sh to detect data leaks, it lacks mechanisms to sanitize or ignore instructions that may be hidden in the skill files being processed.
[DYNAMIC_EXECUTION]: The skill utilizes external tools and scripts that generate behavior dynamically at runtime.
Evidence:
Relies on git filter-repo, a tool that dynamically rewrites commit history based on replacement rules provided in replace.txt and mailmap files.
The script scripts/scan-sensitive.sh dynamically constructs large regular expressions from configuration values (sensitive_patterns) and executes them using grep and git grep against the target directories and history.

agent-skill-sync-manager