The Agent Skills Directory

[PROMPT_INJECTION] (HIGH): The skill is highly vulnerable to Indirect Prompt Injection. 1. Ingestion points: The search --content command reads raw data from files. 2. Boundary markers: Absent in documentation and configuration. 3. Capability inventory: The skill possesses read-write filesystem permissions as specified in package.json. 4. Sanitization: Documentation claims path validation, but this is unverifiable without the source code. An attacker could place malicious instructions in a file that the agent reads, potentially causing the agent to delete or exfiltrate other data.
[NO_CODE] (HIGH): The core executable file ./filesystem defined in package.json is missing. All safety claims (Path Validation, Protected Paths) are documentation-only and cannot be verified against actual implementation.
[COMMAND_EXECUTION] (MEDIUM): The skill performs destructive batch operations like copy and overwrite. While it includes a dry-run mode, the inherent capability to modify the filesystem in bulk presents a significant risk if the agent is misled by injected instructions.

filesystem