The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (e.g., mv, cp, stat, find) using variable interpolation for source and destination paths. As filenames are untrusted data that can contain shell metacharacters (such as backticks, semicolons, or pipe symbols), this pattern creates a risk of arbitrary command execution if the agent does not properly escape the strings when calling subprocesses.
[DATA_EXFILTRATION]: The manifest in tank.json requests the read: ["**/*"] permission. This grants the agent access to the entire filesystem, including sensitive directories like ~/.ssh, ~/.aws, and environment files. While the stated purpose is file organization, there are no technical constraints preventing the agent from reading or exposing sensitive credentials discovered during the scan phase.
[PROMPT_INJECTION]: The skill processes file metadata (names, paths, and content headers) from potentially attacker-controlled sources, such as a Downloads folder. This represents an indirect prompt injection surface where maliciously crafted filenames or file contents (e.g., shebang lines) could attempt to influence the agent's behavior during the analysis or proposal phases.
Ingestion points: Target directories provided by the user (file names and metadata).
Boundary markers: Not present. The skill does not instruct the agent to ignore or delimit instructions found within file metadata.
Capability inventory: The skill has access to subprocess execution and can perform mv, cp, and rm operations across the filesystem.
Sanitization: No specific sanitization or escaping logic is described for handling special characters in filenames before they are passed to shell commands.
[COMMAND_EXECUTION]: The skill logic in references/workflow-guide.md describes an execution phase where moves are performed. However, the tank.json manifest only explicitly grants write access to ~/.folder-organizer/. If the agent attempts to move files in other directories (like ~/Downloads) as instructed, it may attempt to bypass filesystem permission constraints via its subprocess capability.

@tank/folder-organizer