The Agent Skills Directory

[DATA_EXFILTRATION]: The generate and params commands in tim_henson_skill.py accept a --template argument which is converted into a Path object and read using read_bytes(). There is no validation to ensure this path resides within the expected presets directory, allowing the skill to potentially read any file on the filesystem that the user has access to. This could lead to information disclosure if the agent is manipulated into processing sensitive system or user files as templates.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from stdin and processes external .xml files.
Ingestion points: sys.stdin (overrides) and --template (file input).
Boundary markers: None used to separate template content or user overrides from the processing logic.
Capability inventory: File read/write operations and recursive directory scanning.
Sanitization: Output filenames are sanitized, and JSON keys are validated against the template, but the content of the template itself is not validated for malicious instructions.
[PRIVILEGE_ESCALATION]: The script hardcodes PRESET_ROOT and OUTPUT_DIR to paths within /Library/Audio/Presets/. On macOS, these are system-wide directories that often require administrative privileges (root) to modify. The skill attempts to create directories and write binary files to these locations without explicit permission checks, which could fail or be used to overwrite system-level assets if the agent environment is over-privileged.

tim-henson-presets