The Agent Skills Directory

[DYNAMIC_EXECUTION]: The self-hosted remote cache server template provided in SKILL.md (Template 4) incorporates untrusted request parameters (req.params.hash and req.query.teamId) directly into file system paths using Node.js path.join. This pattern is vulnerable to path traversal attacks, potentially allowing a remote attacker to read or write files outside the intended ./cache directory by providing malicious path segments like .. in the request parameters.
[DATA_EXFILTRATION]: The Express server template for self-hosted caching does not include any authentication or authorization mechanisms. If a user deploys this template as-is, it would permit unauthorized network access to build artifacts. When combined with the path traversal vulnerability in the same template, this significantly increases the risk of unauthorized data exposure from the host system.

turborepo-caching