The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/restore.sh implements a file restoration process that takes directory names directly from command-line arguments without validation. It constructs target paths using string concatenation: TARGET_PATH="$TARGET_DIR/$dir". By providing directory names containing path traversal sequences (e.g., ../../.ssh), the script can be manipulated to operate on files and directories outside of the intended ~/.claude/ location.
[PRIVILEGE_ESCALATION]: The lack of path validation in restore.sh allows for arbitrary file writes to sensitive locations within the user's home directory. This can be exploited to achieve persistence or escalate privileges by overwriting critical files such as ~/.ssh/authorized_keys, ~/.bashrc, or other shell initialization scripts.
[INDIRECT_PROMPT_INJECTION]: The skill's workflow involves taking user-supplied or context-derived paths and directory names to perform file operations, creating a significant attack surface for indirect prompt injection. An attacker could embed malicious instructions in a processed file to trick the agent into executing a restore operation with a malicious source and a traversal-based target path. 1. Ingestion points: The source-dir and the list of directories to restore are provided via the agent's interaction with the user or its environment. 2. Boundary markers: The script includes a confirmation prompt before overwriting, but this does not prevent the underlying path traversal vulnerability and can be bypassed by social engineering. 3. Capability inventory: The script possesses recursive file-write capabilities through rsync and cp -rf, as well as directory creation via mkdir -p. 4. Sanitization: There is no sanitization, allow-listing, or path normalization performed on the directory arguments before they are used in file system operations.

config-restore