The Agent Skills Directory

Privilege Escalation (HIGH): The documentation in README.md and SKILL.md suggests running the script with sudo to resolve permission errors. Encouraging users to run file manipulation scripts with root privileges is a high-risk practice that can lead to system-wide compromise.
Persistence Mechanisms (HIGH): The SKILL.md file provides instructions for setting up cron jobs to automate the execution of the organizer script. This establishes a persistent execution path on the user's system which could be exploited if the script is tampered with.
Indirect Prompt Injection (HIGH): The skill's core functionality involves processing untrusted data (filenames and metadata) from the ~/Downloads folder.
Ingestion points: The organizer.py script ingests all filenames in the downloads directory via rglob('*') and iterdir().
Boundary markers: None. There are no instructions or delimiters to prevent an AI agent from interpreting instructions embedded in filenames during analysis or organization tasks.
Capability inventory: The script performs file system operations including mkdir and shutil.move across the user's home directory.
Sanitization: Filenames are used directly in path construction without sanitization or validation, posing a risk of path manipulation and agent logic subversion.
Metadata Poisoning (MEDIUM): The SKILL.md file advertises several 'Integration' features (Slack, Cloud Sync, Obsidian) that are completely absent from the provided Python source code. This misleading metadata can lead users to overestimate the skill's capabilities and security features.

downloads-organizer