The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/platforms.py invokes subprocess.run to execute system commands pgrep (on Unix-like systems) and tasklist (on Windows). These calls are used to verify if specific applications are running before the skill attempts to modify their data. The command arguments are strictly controlled using a hardcoded mapping of application names to process names.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-controlled file and folder names, which constitutes an attack surface for indirect prompt injection if those names contain malicious instructions.
Ingestion points: Untrusted data enters the agent context through the output of scripts/scan_tree.py, which inventories the file names and structure of a target directory.
Boundary markers: The instructions in SKILL.md and references/safe-mutation-rules.md explicitly command the agent to treat filenames, titles, and note bodies as data only, providing specific examples like ignore-previous-instructions.pdf to be treated as a literal string.
Capability inventory: The skill has the ability to move files using shutil.move and delete files by moving them to the system trash using platform-specific APIs (including ctypes calls on Windows).
Sanitization: The scan_tree.py script implements a denied check that uses os.path.realpath to prevent directory traversal and enforces a strict denylist of sensitive paths such as ~/.ssh, ~/.aws, and ~/.gnupg.

organizing-folders