The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The scripts/generate.ts script accepts an --output argument that is passed directly to fs.writeFile without validation or path sanitization. This constitutes an arbitrary file write and path traversal vulnerability, allowing the agent to overwrite sensitive system files (e.g., .bashrc, .ssh/authorized_keys) if instructed by a user or a malicious prompt.\n- [DYNAMIC_EXECUTION]: The script implements a fallback mechanism to resolve its dependencies by dynamically importing modules from paths resolved at runtime. It scans environment variables and searches the user's home directory (specifically ~/.claude/plugins/installed_plugins.json and cache folders) for installation paths. This loading of executable code from non-static, potentially user-writable locations is a significant security risk, especially when combined with the skill's arbitrary file write capability.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted prompts and instructions which are then used to generate content written to the local filesystem. The lack of output path restrictions creates a high-risk surface for indirect prompt injection, where an attacker could manipulate the LLM into performing unauthorized file operations or overwriting critical configurations.\n- [DATA_EXFILTRATION]: The script accesses sensitive configuration files in the user's home directory, such as the Claude plugin metadata file, to resolve its own installation paths. While functionally required for the current implementation, this behavior involves accessing system-wide configuration data that should be handled with higher privilege constraints.

generate-svg