The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements a shell command execution pattern that is vulnerable to command injection. The code snippet terminal(f'python3 /home/ubuntu/.hermes/skills/dalle/scripts/generate.py "{prompt}"') interpolates the user-provided prompt variable directly into a string executed by the terminal. If a user provides a prompt containing shell metacharacters (e.g., "; cat /etc/passwd #), it would result in arbitrary code execution on the host system.
[CREDENTIALS_UNSAFE]: The skill documentation explicitly references and relies upon a sensitive SSH private key located at /home/ubuntu/.ssh/id_vultr and ChatGPT session cookies at /home/ubuntu/.hermes/skills/dalle/chatgpt_cookies.json. Exposing and utilizing hardcoded paths for private keys within skill instructions is a significant security risk that could facilitate credential theft.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via the prompt parameter and interpolates it into a high-privilege tool (terminal) without any sanitization, escaping, or boundary markers. This creates a direct attack surface where malicious input in the image prompt can influence the agent's behavior and the underlying operating system.

dalle-chatgpt