The Agent Skills Directory

[DATA_EXFILTRATION]: Path traversal vulnerability in the state analysis logic. The helper script state_diff.py reads file paths from a user-controlled or data-controlled JSON manifest and accesses them without validation.
Evidence: In state_diff.py, the diff_memory_region function constructs file paths using before_dir / before_entry["file"]. Since before_entry is parsed directly from the memory_map.json file found within the snapshot directory, an attacker can specify absolute paths or traversal sequences (e.g., ../../etc/shadow) in the "file" field to force the script to read arbitrary files from the filesystem and include their contents in the diff report.
[PERSISTENCE]: Insecure file write vulnerability via unvalidated output paths. The skill allows for the redirection of its output report to arbitrary locations on the filesystem.
Evidence: The main function in state_diff.py accepts an --output argument and uses it to define output_path via Path(args.output). The script then performs output_path.write_text(...) without verifying that the destination is within a safe directory. This can be exploited to overwrite sensitive configuration files, such as shell profiles (.bashrc) or SSH authorized keys, with the JSON-formatted diff report.
[INDIRECT_PROMPT_INJECTION]: The skill processes complex, untrusted data structures which serve as an attack surface for influencing agent behavior.
Evidence:
Ingestion points: state_diff.py ingests registers.json, memory_map.json, and multiple binary files from snapshot directories which may be attacker-controlled.
Boundary markers: None. There are no instructions to the agent to treat the contents of the snapshots or the resulting diff_report.json as potentially untrusted data.
Capability inventory: The skill possesses file read/write capabilities (via the Python script) and command execution capabilities (via the Bash tool).
Sanitization: No validation or sanitization is performed on the snapshot data before it is processed by the script or presented to the agent for reasoning.

state-diff