The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a variable {项目名} (slug) to construct file paths for reading and writing operations (e.g., ~/.dbs/sessions/{项目名}/ and mkdir -p ~/.dbs/reports/{项目名}/). There are no instructions to sanitize or validate this variable, which creates a path traversal vulnerability. An attacker could potentially use directory traversal sequences (e.g., ../../) to read or write files outside the intended application directory.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It reads data from multiple Markdown files in the local filesystem and merges their content into a single output.
Ingestion points: Files located in ~/.dbs/sessions/{项目名}/*.md.
Boundary markers: None identified. The skill directly merges fields and body sections.
Capability inventory: Includes directory creation (mkdir -p), file reading, and file writing.
Sanitization: Explicitly absent; the instructions state "no desensitization" is performed even if sensitive information is present.
[DATA_EXFILTRATION]: While the skill primarily operates on application-specific data in ~/.dbs/, the combination of unvalidated path construction and file reading capabilities could be leveraged to access sensitive files on the local system if a path traversal attack is successful.

dbs-report