The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/unpack.py uses zipfile.extractall() without validating the target paths of the archive members. A malicious ZIP file containing entries with directory traversal sequences (e.g., ../../etc/passwd) could be used to overwrite sensitive files on the system where the script is executed.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it is designed to extract and potentially modify content from untrusted ZIP archives provided by users or external sources.
Ingestion points: scripts/unpack.py accepts external ZIP files for extraction.
Boundary markers: Absent. The instructions do not include markers or warnings to treat extracted content as untrusted data.
Capability inventory: The skill includes file system write access through scripts/pack.py and scripts/unpack.py.
Sanitization: The extraction script does not perform any validation or sanitization of the file paths contained within the archive before writing them to disk.

zip-handler