The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to construct and execute a find command by directly interpolating user input into the query string: find ~/Documents/projects -type f -iname "*<query>*". If a user provides a query containing shell metacharacters (e.g., ;, $(...), or backticks), this results in arbitrary command execution on the host system. While the instructions suggest wrapping the query in quotes, this is insufficient to prevent injection if the user input includes quotes that break the command string.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection by processing untrusted data from the filesystem.
Ingestion points: Filenames and paths returned by the find command in SKILL.md.
Boundary markers: None are specified for handling the results of the search before they are surfaced or processed.
Capability inventory: The skill can surface files to the UI using SendUserFile, execute shell commands via find, and launch external applications using the open-with.sh script.
Sanitization: There is no evidence of sanitization or escaping of the filenames retrieved from the disk before they are used as arguments or displayed.
[DATA_EXFILTRATION]: The skill provides the agent with the capability to search and surface any file within the ~/Documents/projects/ directory, with a fallback to the entire ~/Documents/ folder. This grants the agent (and potentially a malicious prompt) broad access to sensitive user data, project source code, and personal documents. The use of SendUserFile to "surface" these files creates a path for sensitive data to be moved into the agent's context and potentially exfiltrated if the agent is subsequently compromised.

open