The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/render_card.py executes the system's Chrome or Chromium binary in headless mode using subprocess.run. Although it uses an argument list rather than a raw shell string, the binary selection depends on searching standard system paths which could be manipulated.
[DATA_EXFILTRATION]: The bg_to_data_uri function in scripts/render_card.py uses urllib.request.urlopen to fetch background images from user-supplied URLs. It lacks validation for the URL scheme, allowing for local file inclusion via file:// protocols. An attacker could use this to read sensitive files like ~/.ssh/id_rsa, which the script then base64-encodes and renders into a PNG image for exfiltration.
[PRIVILEGE_ESCALATION]: The --out parameter allows the agent to specify the destination path for the generated PNG file without any sanitization. This enables the overwriting of arbitrary files on the system, including critical configuration files or shell profiles, which can lead to system instability or persistence.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to arbitrary external domains provided by the user to fetch images, which can be used to probe internal network services or metadata endpoints.

xy-card