The Agent Skills Directory

[DATA_EXFILTRATION]: Path Traversal Vulnerability in cmd_show function.
File: scripts/skills.py
Description: The script constructs a file path by joining a base directory with a user-provided name and a fixed suffix. Because the user input is not validated for path traversal sequences (..) or absolute paths, an attacker can manipulate the name argument to read any file on the system that is named SKILL.md.
Evidence: The line path = SKILLS_DIR / name / "SKILL.md" in the cmd_show function allows the name variable to override the SKILLS_DIR base path if name starts with a forward slash or contains directory traversal components.
[INDIRECT_PROMPT_INJECTION]: Untrusted Data Ingestion Surface.
File: scripts/skills.py
Ingestion points: The skill reads content from SKILL.md files located in subdirectories of /mnt/skills/user/ and prints them to the agent's context via stdout.
Boundary markers: The script does not include any boundary markers, delimiters, or safety warnings when outputting the content of external skills. Instructions from these files are presented as raw text to the agent.
Capability inventory: While this skill primarily performs file reads, it is designed to discover and load other skills which may possess significant capabilities (network access, file modification, etc.). A malicious entry in the skill catalog could provide instructions that trick the agent into misusing those capabilities.
Sanitization: There is no sanitization or filtering of the content read from the SKILL.md files; the script simply replaces invalid encoding characters.

finding-skills