The Agent Skills Directory

Remote Code Execution (CRITICAL): Piped remote execution pattern detected in SKILL.md and references/execution-options.md. The instruction curl -LsSf https://astral.sh/uv/install.sh | sh downloads and executes a shell script from an untrusted external source (astral.sh) directly into the command interpreter without verification.
Data Exfiltration (HIGH): The script scripts/read_docs.py contains a path traversal vulnerability in the resolve_doc_path function. It explicitly checks if the input is a file and returns the resolved path without restricting it to the knowledge-dir. This allows an attacker to read arbitrary files from the filesystem (e.g., scripts/read_docs.py ~/.ssh/id_rsa).
Prompt Injection (LOW): The skill exhibits an Indirect Prompt Injection surface by processing external, potentially untrusted hardware datasheets.
Ingestion points: scripts/ingest_docs.py (processes PDF, DOCX, HTML, Markdown, XLSX/CSV).
Boundary markers: Absent; the content is normalized and stored without markers to separate data from instructions.
Capability inventory: Command execution via uv run, file reading, and searching.
Sanitization: Absent; no sanitization or escaping is performed on the ingested content.
Command Execution (MEDIUM): The script scripts/search_docs.py allows the use of arbitrary regular expressions via the --regex flag. Maliciously crafted regex patterns could be used to perform Regular Expression Denial of Service (ReDoS) against the agent's environment.

datasheet-intelligence