The Agent Skills Directory

[COMMAND_EXECUTION]: Path traversal vulnerability in scripts/handler.sh. The search_error_code function constructs a cache file path using the manufacturer, model, and error_code variables without sanitizing for directory traversal characters (e.g., ../). This allows an attacker to potentially read or overwrite .json files outside the intended cache directory when the agent performs an error lookup. Evidence in scripts/handler.sh: cache_key=$(echo -n "${manufacturer}-${model}-${error_code}" | tr ' ' '-' | tr '[:upper:]' '[:lower:]') followed by cache_file="$CACHE_DIR/error-${cache_key}.json" and cat "$cache_file".
[PROMPT_INJECTION]: Vulnerability to indirect prompt injection. The skill stores user-provided device metadata such as nicknames and notes in devices.json and later retrieves and displays this information to the agent without sanitization or boundary markers. A malicious user could store instructions in these fields that target the agent when it later retrieves device information. 1. Ingestion points: add and update commands in scripts/handler.sh accepting arbitrary JSON data. 2. Boundary markers: Absent in the output generated by the info and list commands. 3. Capability inventory: The skill has file system read/write access and shell execution capabilities. 4. Sanitization: No sanitization or validation of string fields against prompt injection patterns.

device-assistant