The Agent Skills Directory

[DATA_EXFILTRATION]: The save operation defined in SKILL.md exposes a source_file parameter. The underlying script scripts/templates.py reads the contents of this file directly without validating that the path is within a restricted or safe workspace. This capability allows an attacker or a malicious prompt to read arbitrary files from the agent's environment, such as .env files, SSH configurations, or system logs, and save them into the template library where they can be retrieved.
[COMMAND_EXECUTION]: The scripts/templates.py script is vulnerable to path traversal through the name argument. The template file path is constructed by joining the root directory, category, and the user-supplied name (e.g., os.path.join(root, category, f"{name}.md")). Since the name is not sanitized for directory traversal characters like .., it is possible to manipulate the target path for read (get), write (save/edit), and delete (delete) operations, although the forced .md extension provides a minor constraint.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests untrusted content through source_text, source_file, and template variables during the save and use operations.
Boundary markers: None. There are no delimiters or specific instructions to the agent to disregard commands or instructions embedded within the template data.
Capability inventory: The skill can read arbitrary files and write files to the filesystem.
Sanitization: No sanitization, escaping, or validation is performed on the content being saved to or read from templates, which could allow malicious instructions in a template to influence the agent's future behavior.

template-library