The Agent Skills Directory

[DATA_EXFILTRATION]: A path traversal vulnerability exists in the persist_design_system function located in scripts/design_system.py. The script constructs filesystem paths using a user-provided project_name without sanitizing traversal characters or absolute path prefixes. In Python, using the Path division operator with an absolute path as the second operand overrides all preceding path components. This allows a malicious project name to specify arbitrary locations for directory creation and file writing, circumventing the intended design-system/ directory restriction.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted user input and incorporating it into its internal logic and generated documentation. 1. Ingestion points: User-supplied queries and project names are ingested via CLI arguments in scripts/search.py and scripts/design_system.py. 2. Boundary markers: The generated design system documentation (MASTER.md and page-specific files) lacks delimiters or protective instructions to prevent the agent from interpreting generated content as directives. 3. Capability inventory: The skill has the capability to write files to the host system through the persistence feature. 4. Sanitization: No sanitization is performed on search terms or project names before they are processed or used to construct filesystem paths.
[SAFE]: All identified external URL references in the skill's CSV data files point to official documentation for reputable and well-known services, such as React, Next.js, Astro, and Tailwind CSS. References to icon libraries point to standard industry sets such as Lucide and Heroicons.

ui-ux-pro-max