The Agent Skills Directory

[COMMAND_EXECUTION]: Path traversal vulnerability detected in handler.js. The name parameter provided in user arguments is used directly in path.join (lines 33 and 39) to construct filesystem paths. Because the input is not sanitized, an attacker can use .. sequences to navigate out of the .snippets directory and access other parts of the filesystem.
[DATA_EXFILTRATION]: Arbitrary file read capability. The traversal vulnerability in the get command allows an attacker to read sensitive files such as .env, SSH keys, or cloud credentials (e.g., run snippets get ../../../.aws/credentials) that the execution environment has access to.
[DATA_EXFILTRATION]: Unauthorized file modification. The save command can be exploited via traversal to overwrite existing files or create files in unauthorized locations, which could be used to disrupt service or modify application logic.
[PROMPT_INJECTION]: Indirect prompt injection surface. The skill manages untrusted code snippets that are later retrieved into the agent's context without safety controls.
Ingestion points: Snippet content is ingested via args.trim().split and parts.slice(2).join in handler.js (lines 25-32).
Boundary markers: No delimiters or "ignore instructions" warnings are present when retrieving snippets.
Capability inventory: Includes fs.writeFileSync and fs.readFileSync operations in handler.js across the sandbox directory.
Sanitization: No sanitization or validation is performed on the snippet content or the snippet name before storage or retrieval.

snippets