The Agent Skills Directory

[DATA_EXFILTRATION]: The skill contains a vulnerability in its 'Image-to-Image' generation flow where the REF_IMAGE variable allows specifying an arbitrary local file path.
Evidence: The script uses curl -F "image=@$REF_LOCAL" to upload the file contents to the endpoint specified in GPT_IMAGE_BASE_URL.
Risk: If an attacker can influence the REF_IMAGE value, they can exfiltrate sensitive files such as ~/.ssh/id_rsa, .env, or system credentials to a remote server.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because user-provided inputs are used to build the image generation prompt.
Ingestion points: User-supplied book title (书名), author name (作者名), and style preferences.
Boundary markers: Absent; the skill uses direct string interpolation to construct prompts (e.g., Title text '{书名}').
Capability inventory: Shell execution (curl, magick, sips), file system access (read/write), and network transmission of data.
Sanitization: Absent; there is no validation or escaping of the metadata before interpolation.
[COMMAND_EXECUTION]: The skill executes multiple bash scripts that utilize environment variables and user-provided inputs.
Evidence: Variables like BOOK_DIR and REF_IMAGE are used in shell commands such as mkdir -p, ls, and curl.
Risk: Reliance on shell execution with unvalidated user-supplied paths increases the attack surface for command injection.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of remote files via curl.
Evidence: The script detects URLs in the REF_IMAGE parameter and downloads them to temporary files.
Risk: This mechanism can be used to pull arbitrary external content into the agent's working directory.

story-cover