The Agent Skills Directory

[DATA_EXFILTRATION]: A path traversal vulnerability exists in the provided API translation route template.
Evidence: In references/templates/LocaleRoutes.php.md, the route Route::get('/translations/{locale}', ...) uses the {locale} parameter directly to construct a file path via lang_path("{$locale}.json") which is then passed to file_get_contents(). Unlike other routes in the template, this specific route lacks a where constraint or whitelist validation.
Impact: An attacker can read arbitrary JSON files within the project (such as composer.json or package.json) by supplying directory traversal sequences (e.g., /api/translations/..%2Fcomposer).
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external data to control application localization, creating an attack surface for indirect prompt injection.
Ingestion points: Untrusted data is ingested from URL segments (references/templates/LocaleRoutes.php.md), browser Accept-Language headers (references/templates/LocaleRoutes.php.md), and session data.
Boundary markers: Absent. The skill does not recommend or implement delimiters or "ignore" instructions when interpolating translated strings containing user-controlled placeholders into the application output.
Capability inventory: The skill utilizes App::setLocale, file_get_contents, and custom Blade directives for dynamic content generation.
Sanitization: While some middleware templates implement Locale::tryFrom() validation, the API translation route lacks any sanitization or validation, leaving a direct path for input manipulation.

laravel-i18n