The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script scripts/design_system.py contains a directory traversal vulnerability in the persist_design_system function.
The script constructs file paths by joining a base directory with a project name and page name provided via user-controlled input (the search query or command arguments).
These inputs are not sanitized for traversal sequences such as ../, which allows the agent to write or overwrite markdown files in unauthorized locations on the host system, depending on the permissions of the environment.
This could be used to manipulate configuration files or achieve persistence if the agent is directed to write to specific system paths.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it processes data from its external CSV databases.
Ingestion points: User search queries trigger the retrieval of data from multiple local CSV files (data/*.csv) containing guidelines and reasoning rules.
Boundary markers: The retrieved content is formatted and presented to the agent without any clear delimiters or instructions to ignore potential commands embedded within the text.
Capability inventory: The skill has the capability to write files to the disk and recommends the execution of system-level commands for prerequisite installation, which increases the impact if a data source were compromised with malicious instructions.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the text content loaded from the database files before it is processed by the AI agent.

ui-ux-pro-max