The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/download.sh script and a corresponding recipe in SKILL.md are vulnerable to path traversal. The implementation uses the name field directly from the Figshare API response to construct local file paths (curl -o "$OUT/$name"). If a Figshare article contains malicious filenames like ../../.bashrc, the script could overwrite arbitrary files on the host system. \n- [REMOTE_CODE_EXECUTION]: The skill features an update mechanism in SKILL.md that instructs the agent to run git pull --ff-only to update the skill from its remote origin. While this involves a user confirmation step, it enables the execution of remote code changes that could be modified by a malicious actor if the repository is compromised. \n- [INDIRECT_PROMPT_INJECTION]: The skill interacts with public research articles on Figshare, creating a surface for indirect prompt injection. Malicious instructions could be embedded in article titles, descriptions, or the contents of downloaded files to influence the agent's behavior. \n
Ingestion points: Figshare API metadata and downloaded file contents processed via scripts/download.sh and SKILL.md recipes. \n
Boundary markers: The instructions do not define clear boundaries or 'ignore' directives for content retrieved from Figshare. \n
Capability inventory: The skill has access to shell execution (bash, curl), filesystem writing, and network access. \n
Sanitization: Filenames and article metadata are used without sanitization or validation. \n- [EXTERNAL_DOWNLOADS]: The skill downloads files from Figshare's public API and repository updates from the configured git origin repository.

figshare-skill