The Agent Skills Directory

[COMMAND_EXECUTION]: The server logic in scripts/dashboard.mjs is vulnerable to command injection via the /outputs/ route. The fileName parameter is extracted from the URL and used in an execSync call to the afconvert utility. Although the path is checked for traversal, the filename is not sanitized for shell metacharacters (e.g., ;, &, |), allowing an attacker or a maliciously named generated file to execute arbitrary shell commands.- [REMOTE_CODE_EXECUTION]: The dashboard server uses Access-Control-Allow-Origin: '*' and Access-Control-Allow-Methods: 'GET,POST,OPTIONS'. Combined with the lack of authentication, this allows any website the user visits in their browser to interact with the local API. An attacker could trigger the /api/generate/ endpoint, which invokes the Claude agent to execute shell commands, leading to remote code execution on the user's host machine.- [DATA_EXFILTRATION]: The server exposes sensitive metadata and document chunks from the user's ~/.notebook-plugin/ directory through the /api/state and /api/events endpoints. Due to the permissive CORS configuration, this sensitive information can be read and exfiltrated by any malicious website visited by the user while the dashboard is running.- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. The /api/generate/ endpoint accepts a topic string from the request body and interpolates it directly into a complex prompt sent to the Claude agent without proper escaping or boundary markers. This allows the topic content to potentially override agent instructions and execute unauthorized commands via the agent's shell access. [Ingestion points: scripts/dashboard.mjs POST /api/generate/]; [Boundary markers: Absent]; [Capability inventory: spawn of claude, bun, uv; execSync of afconvert]; [Sanitization: Absent].

dashboard