The Agent Skills Directory

[COMMAND_EXECUTION]: Path Traversal vulnerability in file write operations.\n
Files: src/zendesk_skill/operations.py (function download_attachment) and src/zendesk_skill/storage.py (function save_response).\n
Evidence: Both functions accept a user-provided output_path or construct a path using a filename extracted from a URL without adequate sanitization. An attacker could manipulate these paths (e.g., using ../../) to create or overwrite sensitive files on the system outside the intended storage directory.\n- [PROMPT_INJECTION]: Susceptibility to Indirect Prompt Injection (Category 8).\n
Ingestion points: src/zendesk_skill/operations.py (functions get_ticket_details, search_tickets, and download_attachment). The skill ingests untrusted data from ticket comments and search results.\n
Capability inventory: The skill can perform network operations via httpx, write to the file system, and execute jq logic using subprocess.run (src/zendesk_skill/queries.py).\n
Sanitization: The skill implements mitigations by using prompt-security-utils to wrap untrusted content and instructions for the agent to ignore instructions within the wrapped blocks.\n
Boundary markers: Present in src/zendesk_skill/server.py and src/zendesk_skill/operations.py.\n- [EXTERNAL_DOWNLOADS]: Support for an external OAuth relay server.\n
File: src/zendesk_skill/auth/server.py.\n
Evidence: The skill allows configuration of an external relay server for managing OAuth tokens. While documented as a feature for team deployments, it introduces a risk of credential exfiltration if a user is socially engineered into configuring a malicious server URL.

zendesk