The Agent Skills Directory

[COMMAND_EXECUTION]: The checkout.sh script is vulnerable to path traversal due to insufficient validation of repository components. The parse_repo function extracts host, organization, and repository names from a provided URL or shorthand but does not filter for parent directory references (..). These unsanitized components are then used to construct the local filesystem path where the repository will be cloned.
Evidence: In checkout.sh, the variables $host, $org, and $repo are concatenated to form the $checkout_path variable: checkout_path="$cache_root/$host/$org/$repo".
Evidence: The script performs mkdir -p "$(dirname "$checkout_path")" and git clone ... "$checkout_path". A crafted input such as https://../../target/dir would resolve to a path outside the intended ~/.cache/checkouts/ root, allowing the creation of directories and git repository metadata in arbitrary locations within the user's home directory.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to be triggered by repository references found in external context (e.g., when the agent "encountered a remote git repo through other means"). This creates a vulnerability surface where a malicious document can provide a crafted repository string to exploit the path traversal issue.
Ingestion points: The <repo> argument in SKILL.md instructions, which the agent is directed to extract from user input or external references.
Boundary markers: Absent. There are no instructions for the agent to validate the repository string or use delimiters when passing the identifier to the script.
Capability inventory: The skill utilizes mkdir for directory creation and git clone and git fetch for network-to-disk operations.
Sanitization: While checkout.sh parses the structure of git URLs, it lacks any validation or escaping to prevent directory traversal sequences from affecting the final checkout path.

librarian