The Agent Skills Directory

[COMMAND_EXECUTION]: In scripts/providers/google.ts, the function postGoogleJsonViaCurl uses execSync to run a curl command. It directly interpolates the HTTPS_PROXY and GOOGLE_BASE_URL environment variables into the shell command string without proper sanitization. An attacker who can control these variables—for example, by placing a malicious .env file in the project directory—can execute arbitrary shell commands on the system.
[DATA_EXFILTRATION]: The insecure curl command in scripts/providers/google.ts includes API keys in its request headers. A command injection exploit targeting the proxy or URL parameters could be used to intercept these headers and exfiltrate the keys to a remote server controlled by an attacker.
[DATA_EXFILTRATION]: The scripts/main.ts file automatically loads environment variables from a .env file located in the current working directory. If an agent is directed to work in an untrusted directory containing a malicious .env file, the skill's behavior can be hijacked to perform unauthorized actions or exfiltrate data.

image-gen