The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/delete_skill.py is vulnerable to path traversal. The skill_dir for deletion is constructed by joining a root path with a user-supplied skill name (Path(skills_root) / skill_name) without validating that the final path remains within the intended root. This allows for the deletion of arbitrary directories if the skill name contains traversal sequences like ../../target.
[COMMAND_EXECUTION]: The scripts/scan_and_check.py script uses subprocess.run to execute git ls-remote using URLs parsed from the metadata of installed skills. Maliciously crafted URLs (e.g., using git ext:: transport or option injection like --upload-pack) could lead to arbitrary command execution on the host machine during update checks.
[DYNAMIC_EXECUTION]: In scripts/evo_manager.py, the skill dynamically modifies the Python search path (sys.path) to import modules from a sibling directory (../../skill-evolution/scripts). This dynamic loading pattern assumes a trusted environment layout and could be exploited to load malicious code if the filesystem structure is manipulated.
[INDIRECT_PROMPT_INJECTION]: The skill scans and processes SKILL.md files within the configured skills_dir. These files, which could be supplied by external sources, serve as untrusted ingestion points for the URLs and skill names used in the aforementioned command execution and file operations. The scripts lacks boundary markers or sanitization to prevent metadata from triggering these vulnerabilities.

skill-manager