The Agent Skills Directory

[COMMAND_EXECUTION]: The Streamlit Web UI implementation in streamlit_ui.py is vulnerable to a 'ZipSlip' attack. The script uses zipfile.extractall() to unpack uploaded ZIP archives without validating whether the file paths within the archive contain directory traversal sequences (e.g., ../../). A maliciously crafted archive could overwrite sensitive system files or configuration files (like .bashrc or SSH keys) on the host machine with the permissions of the user running the tool.
Evidence: zip_ref.extractall(temp_path) in streamlit_ui.py line 140.
[DATA_EXFILTRATION]: The skill presents an indirect prompt injection surface (Category 8) because it ingests untrusted data from scanned skills and includes it in reports seen by the agent.
Ingestion points: skill_scanner.py reads file content from the directory provided to SkillScanner.scan(). streamlit_ui.py accepts file uploads and raw text for analysis.
Boundary markers: None. The scan report includes code snippets from the audited files without any delimiters or instructions to the agent to disregard embedded commands.
Capability inventory: The tool has extensive file-read capabilities across the user's filesystem.
Sanitization: Line content is truncated to 200 characters in skill_scanner.py but is not escaped or sanitized to prevent the agent from interpreting instructions contained within the audited code.

skill-scanner-hardened