The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The documentation in SKILL.md and README.md explicitly suggests using sudo to run the cleanup script and chmod to modify folder permissions to resolve access issues. Recommending the use of administrative privileges for a file organization script is a risky practice that could lead to unauthorized system-wide changes.
[PERSISTENCE]: The skill provides instructions for setting up automated maintenance using cron jobs. Specifically, it suggests scheduling the script to run weekly at 2 AM or daily at 9 AM. While intended for convenience, these instructions demonstrate how an attacker could establish persistence for a script on the user's system.
[METADATA_POISONING]: There is a substantial mismatch between the capabilities documented and the actual code provided. The SKILL.md and README.md claim support for duplicate detection, Obsidian vault integration, Slack notifications, iCloud sync, and advanced time-based cleanup. However, the scripts/organizer.py implementation only contains basic logic for file categorization and analysis, lacking all of the aforementioned advanced features. This deceptive documentation could mislead users or agents regarding the skill's actual footprint and requirements.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user's ~/Downloads folder, specifically filenames and file attributes.
Ingestion points: Filenames and file metadata are read from the local file system using rglob in scripts/organizer.py and presented in reports.
Boundary markers: There are no markers or instructions to ignore potential commands embedded in filenames.
Capability inventory: The skill has the ability to move and delete files (shutil.move) and create directories (pathlib.mkdir).
Sanitization: The script performs no sanitization of filenames before using them in path construction or analysis reports, which could potentially influence the agent's interpretation of the folder's state.

downloads-organizer