The Agent Skills Directory

[DATA_EXFILTRATION]: The script scripts/render_card.py contains a vulnerability where the visual.path parameter from the input JSON is resolved and read into memory regardless of its location on the filesystem. This allows an attacker to trick the agent into reading sensitive local files (e.g., SSH keys, configuration files, or credentials) and embedding them into the generated HTML output.
Evidence: The function data_url(path) in scripts/render_card.py calls path.read_bytes() on the resolved path and returns a Base64 encoded string. There is no validation to ensure the path points to an image file or is restricted to a specific directory.
Evidence: The workflow in SKILL.md encourages the agent to accept local image paths from the user or context, which can be manipulated into providing paths like ~/.ssh/id_rsa or /etc/passwd.
[COMMAND_EXECUTION]: The skill executes external binaries to perform rendering tasks, which increases the attack surface if the input HTML or parameters are manipulated.
Evidence: scripts/render_card.py uses subprocess.run to launch a headless Chrome/Chromium instance. It uses the --no-sandbox flag, which reduces the browser's security isolation.
Evidence: scripts/profile_store.py performs atomic file writes and permission changes (chmod 0o600) on user profile files. While intended for security, the logic allows the script to modify file permissions on the local filesystem based on user-defined paths.
[OBFUSCATION]: The skill includes a large, minified third-party JavaScript library (assets/modern-screenshot.js).
Evidence: The file is a 55KB minified bundle. While it is attributed to an MIT-licensed project, its inclusion as a local, minified artifact makes it difficult to audit for hidden behaviors or vulnerabilities within the context of the skill's execution environment.

lov-gen-card