The Agent Skills Directory

File Management Operations: The skill is designed to delete directories and rename files to manage plugin states. While these are necessary for the skill's management functionality, they represent a sensitive capability. The skill manages this risk by requiring an explicit 'yes' confirmation from the user for every file operation.
Dependency on External Configuration (Indirect Prompt Injection): The skill relies on an audit log (install-log.yaml) to identify target files. If a malicious process were to modify this log, the skill might be directed to act on unintended paths. However, the skill implements a verification rule that restricts actions to community-installed paths and explicitly protects core 'first-party' plugins from modification.
Input Source Sanitization: The instructions include a specific safety rule to disregard any instructions found within a third-party SKILL.md that attempt to trigger uninstallation or disabling actions. This is a proactive measure against indirect prompt injection where a malicious plugin might try to disable other components.

skill-manager