The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a run_bash tool in lib/tools.js that allows the AI agent to execute arbitrary shell commands on the host system using spawnSync("bash", ["-c", cmd]). While documented, this represents a significant security risk if the agent is manipulated.
[DATA_EXFILTRATION]: The /file endpoint in server.js is vulnerable to Local File Inclusion (LFI). It takes a path query parameter and serves the file without ensuring it resides within the intended working directory. An absolute path (e.g., /etc/passwd or ~/.ssh/id_rsa) can be used to read sensitive files from the host.
[REMOTE_CODE_EXECUTION]: The local Express server created by server.js lacks any authentication, authorization, or Cross-Site Request Forgery (CSRF) protection. Because it listens on a predictable range of localhost ports (3031-3040), a malicious website visited by the user could send requests to this server to trigger tools like run_bash or write_file.
[CREDENTIALS_UNSAFE]: The /token endpoint in server.js fetches and serves an OpenAI ephemeral client secret to the frontend. Due to the lack of server-side access controls, this sensitive credential can be harvested by any process or website capable of making local network requests.
[EXTERNAL_DOWNLOADS]: The scripts/launch.js script automatically executes npm install to download and install Node.js dependencies if the node_modules directory is missing. While the listed dependencies are common libraries, this mechanism can be used to pull external code into the local environment.
[PROMPT_INJECTION]: The skill generates a system prompt for the OpenAI Realtime agent using user-provided data (topic and instructions) in config.json. This creates an attack surface for indirect prompt injection if the data being processed (files, notes, etc.) contains malicious instructions meant to override agent behavior.

quick-voice