aicut-editing

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill documentation describes endpoints that can serve arbitrary absolute filesystem paths (/api/media/serve?path= and POST /api/media/generate-thumbnail with filePath) and APIs that write/delete project folders and full snapshots (archiveProject, deleteProject, updateSnapshot), plus a poll endpoint — together these features enable straightforward local file exfiltration, arbitrary filesystem writes/deletions, and possible covert command/data channels if path/project-name validation or auth are missing.