The Agent Skills Directory

[NO_CODE]: The skill package is incomplete. The package.json file defines a binary executable at ./filesystem, and the documentation refers to a filesystem script, but the executable itself is not included in the skill's file set.
[PROMPT_INJECTION]: The SKILL.md file contains an 'OpenSquilla Compatibility Contract' section that provides specific behavioral overrides. It instructs the agent to return specific hardcoded strings (e.g., PACKAGING_BLOCKED) and explicitly forbids the agent from performing certain discovery tasks ('do not try to discover unrelated config files'), which acts as a form of instruction steering or bypass of standard autonomous behavior.
[COMMAND_EXECUTION]: The SKILL.md metadata explicitly requests the command-exec capability. While appropriate for some filesystem tools, this is a high-privilege permission that increases the impact of other vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which creates a vulnerability surface.
Ingestion points: The filesystem search command (with the --content flag) reads the contents of local files and passes them into the agent's context. The filesystem list command also ingests directory structures.
Boundary markers: The instructions do not define clear delimiters or provide 'ignore embedded instructions' warnings when the agent processes file content.
Capability inventory: The skill metadata requests command-exec, filesystem-read, and filesystem-write capabilities.
Sanitization: There is no evidence of sanitization or filtering of the content read from files before it is interpolated into the agent's reasoning process.
[EXTERNAL_DOWNLOADS]: The documentation references external installation methods via git clone from github.com/gtrusler/clawdbot-filesystem and downloads from clawdhub.com. These are documented as standard installation procedures and are not triggered automatically during analysis.

filesystem