The Agent Skills Directory

[COMMAND_EXECUTION]: Code injection vulnerability in kanban_agent_skill/exports.py.
The kb_export_for_sharing function accepts a board_url parameter and writes it directly into a Python source file using simple string replacement: code.replace(needle, f'DISTRIBUTED_BOARD_URL = "{url}"', 1).
There is no sanitization or escaping of the url variable before it is interpolated into the code string. An attacker providing a payload such as "; import os; os.system('...') # could inject and execute arbitrary Python code when the exported skill is later loaded or refreshed by another user.
[DATA_EXFILTRATION]: Unauthenticated API and data exposure.
The board's backend server (server.js) and API routes (e.g., /ajax/tasks/board/get, /ajax/tasks/task/save) do not implement any authentication or authorization mechanisms.
As explicitly stated in the documentation, anyone who knows the URL of a published board has full read/write/delete access to all data stored on that board. This presents a significant risk of data exposure if the skill is used to manage sensitive information.
[PROMPT_INJECTION]: Indirect Prompt Injection attack surface.
The skill is designed to ingest data from an external, potentially public, board via kb_list_tasks and kb_get_task.
Ingestion points: exports.py via _post calls to the resolved board URL.
Boundary markers: None. The agent is not instructed to treat board content as untrusted data.
Capability inventory: The agent can perform file system operations (via the preview tool and kb_export_for_sharing) and network operations.
Sanitization: None. Malicious instructions embedded in task titles or descriptions by an attacker could be processed and followed by the agent.

kanban