The Agent Skills Directory

[DATA_EXFILTRATION]: The scripts/render-travel-guide.py script includes an image_url function that handles local file paths provided in the input JSON. It uses Path.expanduser() and Path.resolve() to locate files, then reads their contents and encodes them into Base64 data URIs. Because there are no restrictions limiting access to specific directories or verifying that the files are actually images, a malicious input could be used to exfiltrate sensitive system files (e.g., SSH keys, configuration files) by embedding them in the rendered HTML output.
[COMMAND_EXECUTION]: The tests/test_scripts.py file employs subprocess.run to execute the skill's CLI tools. While this is standard practice for testing, it involves spawning new processes and interacting with the system shell, which is flagged as a potential risk factor if the test environment is not isolated.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8). It ingests untrusted data from web research and traveler preferences in SKILL.md and references/research-and-evidence.md. These inputs are interpolated into the agent's context to create editorial content and day cards without explicit boundary markers or 'ignore embedded instructions' warnings. While the render-travel-guide.py script correctly uses HTML escaping for the final output, the agent's internal reasoning process could be influenced by malicious instructions hidden in the data it processes.

travel-guide