The Agent Skills Directory

[DATA_EXFILTRATION]: The html_tools.py script accepts a user-controlled image_url and attempts to read it as a local file if it exists. This allows for the exposure of sensitive system files (e.g., ~/.ssh/id_rsa, /etc/passwd) by embedding their Base64-encoded content into the generated HTML. Additionally, it uses urllib.request.urlopen to fetch remote images, which can be abused for Server-Side Request Forgery (SSRF).
[PRIVILEGE_ESCALATION]: The skill allows the agent to specify an arbitrary output_path for the generated HTML file. An attacker could influence the agent to overwrite critical system or user configuration files (such as .bashrc or cron jobs) to gain persistence or elevate privileges.
[DYNAMIC_EXECUTION]: The HTML generator in html_tools.py interpolates variables like product_name, price, evaluation, and JSON-derived strings directly into the HTML template without proper escaping or sanitization. This leads to a persistent Cross-Site Scripting (XSS) vulnerability where malicious scripts provided through vision or search tool outputs can be executed in the user's browser.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded in processed data. Ingestion points: Vision tool description and search results (SKILL.md). Boundary markers: Absent; external content is interpolated directly. Capability inventory: File reading, arbitrary file writing, network requests, and command execution in html_tools.py and SKILL.md. Sanitization: Absent; multiple fields are embedded into shell commands and HTML templates without escaping.
[COMMAND_EXECUTION]: The skill constructs a shell command to run a Python script using values extracted from untrusted external sources. If the agent fails to properly escape these strings (e.g., if they contain backticks or semicolons), it could lead to arbitrary command execution on the host system.

gift-evaluator