The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The scaffold-component.sh script is susceptible to path traversal via the --name and --module arguments. These parameters are used to construct the destination path for the generated component without any validation. An attacker can use traversal sequences like ../ to write files to arbitrary locations, which could lead to the modification of sensitive configuration files or system persistence.
[DATA_EXFILTRATION]: The scripts extract-structure.sh and validate.sh allow an attacker to read arbitrary files by providing a malicious path as an argument. The scripts do not verify that the target files are within the intended project directories. This can lead to the exposure of sensitive information, such as system configuration or credentials, if the processed content is displayed in the agent's output.
[DYNAMIC_EXECUTION]: The scaffolding logic in scaffold-component.sh generates new React components by performing string replacement on templates using unvalidated user input. This creates a code injection vulnerability where malicious code can be embedded directly into the production source code being generated.
[COMMAND_EXECUTION]: In scaffold-component.sh, user-provided variables are directly interpolated into sed command strings. This allows for manipulation of the stream editor's internal logic, potentially allowing an attacker to execute unintended file operations or bypass the intended transformation logic.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes external HTML design prototypes. Since the content of these files is not sanitized and the agent uses the extracted data for critical implementation decisions, a specially crafted HTML file could influence the agent's behavior or cause it to produce insecure code.
Ingestion points: scripts/extract-structure.sh reads user-provided HTML files.
Boundary markers: No delimiters or warnings are used to differentiate between structural data and potentially malicious instructions within the HTML.
Capability inventory: The skill has the capability to write files (scaffold-component.sh) and execute shell commands (Bash tool).
Sanitization: No validation or sanitization is performed on the data extracted from the HTML prototypes.

design-to-production