The Agent Skills Directory

[DATA_EXFILTRATION]: Path traversal vulnerability in the logo embedding logic. The _apply_json_spec function in scripts/mtgx.py processes a logo_dir and a logos mapping from user-provided JSON/NDJSON data. The script uses os.path.join to construct file paths without validating that the final path remains within the intended directory. This allows an attacker to specify sensitive system paths (e.g., ../../.ssh/id_rsa or /etc/passwd) which the script then reads and embeds as Base64-encoded strings within the resulting .mtgx archive.\n- [COMMAND_EXECUTION]: Risk of arbitrary file access through tool invocation. Several commands in the mtgx.py script, such as embed and create, take file paths as direct arguments and perform read operations. In the context of an AI agent, a prompt injection attack could influence the agent to run these commands against sensitive local files, causing the tool to read and potentially expose their contents to the user or an external process.\n- [PROMPT_INJECTION]: Indirect prompt injection surface due to unvalidated data processing. The skill ingests complex external data formats, including JSON, NDJSON, and XML (embedded in MTGX archives), without using boundary markers or sanitization. This provides a vector for malicious data to influence the agent's internal state or subsequent actions.\n
Ingestion points: Data parsing in scripts/mtgx.py via read_json_spec (JSON/NDJSON) and read_mtgx (XML/GraphML via ElementTree).\n
Boundary markers: Absent. The script does not use delimiters or instructions to ignore embedded commands within the processed data.\n
Capability inventory: The tool possesses file-read and file-write capabilities, and is intended to be executed by the agent via shell commands.\n
Sanitization: Absent. There is no validation, escaping, or filtering of the content extracted from external data sources before it is processed or used in graph generation.

mtgx