The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted HTML and MHTML archives containing user-generated comments and descriptions from external issue trackers. This content is used to generate reports that influence the agent's decision-making in subsequent "patch fetch" stages.
Ingestion points: The scripts/parse_local_issue_archive.py script reads and extracts text from files provided via the --archive-dir argument.
Boundary markers: The extracted content is structured into Markdown and JSON sections, but it lacks explicit boundary markers or system instructions to the agent to treat this data as untrusted.
Capability inventory: The generated report determines if an agent should proceed with fetching patches, a process that typically involves network and file system access.
Sanitization: The script performs standard HTML tag stripping but does not implement filters or sanitization logic to mitigate prompt injection payloads embedded in bug comments.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script scripts/parse_local_issue_archive.py. While this is the intended functionality, the script contains a security flaw in its file handling.
Evidence: In scripts/parse_local_issue_archive.py, the extract_zip_inputs function constructs target paths using target = target_root / info.filename. It fails to validate that info.filename does not contain directory traversal sequences (e.g., ../), which could allow a malicious ZIP archive to write or overwrite files outside the intended temporary directory.

arkweb-security-patch-intake