The Agent Skills Directory

[DATA_EXFILTRATION]: Path traversal and absolute path injection vulnerability in scripts/check-citations.py. The script parses file paths (referred to as corpus-path) from the ## Decision-Token Legend table in the document being audited. It resolves these paths using the pathlib operation root / path_part. Since path_part is taken directly from the untrusted document content, an attacker can provide an absolute path (e.g., /etc/passwd) or a traversal path (e.g., ../../.ssh/id_rsa) which pathlib will resolve to a location outside the workspace root. The script then reads the file's content to extract titles or JSON data, potentially exposing sensitive information.\n
Evidence: In scripts/check-citations.py, the resolve_pointer function accepts a pointer string, extracts the path_part, and constructs fpath = root / path_part. The file is then read via fpath.read_text() in the extract_md_title function.\n- [COMMAND_EXECUTION]: The skill invokes several local scripts to perform audit tasks, including scripts/check-citations.py, scripts/check-inheritance.py, and scripts/check-review-header.py. These are executed via the shell using the uv run command. Additionally, the skill references a shared utility script ${CLAUDE_PLUGIN_ROOT}/skills/_shared/now.mjs for timestamp generation.\n- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8).\n
Ingestion points: The skill loads and parses a *-gate.md file from the workspace root, as specified in the Input section of SKILL.md.\n
Boundary markers: None. The skill lacks delimiters or explicit warnings to the agent to treat the document content as data rather than instructions.\n
Capability inventory: The skill can execute shell commands for its Python and Node.js scripts, write finding reports back to the workspace files, and access the host file system via the vulnerability in its citation script.\n
Sanitization: None. The skill does not filter or sanitize the contents of the audited document before processing it or passing its contents to shell scripts.

gate-review