The Agent Skills Directory

[Data Exposure & Exfiltration] (HIGH): The skill allows arbitrary file access through user-controlled path parameters.\n
Evidence: In multi_turn_chat.py, the /load command opens images using Image.open(path) without verification.\n
Evidence: In generate_image.py and edit_image.py, the output_path argument is passed directly to image.save(). Because pathlib.Path joins treat absolute paths as overrides, a user can overwrite sensitive system files (e.g., /etc/hosts) by providing an absolute path.\n- [Indirect Prompt Injection] (HIGH): The skill processes untrusted user instructions and passes them to a high-capability AI model without sanitization, creating a risk of malicious instructions being executed via file operations.\n
Ingestion points: User CLI arguments in generate_image.py and interactive input in multi_turn_chat.py.\n
Boundary markers: Absent.\n
Capability inventory: image.save() (file-write capability) in scripts/generate_image.py, scripts/edit_image.py, and scripts/multi_turn_chat.py.\n
Sanitization: Absent.\n- [Metadata Poisoning] (LOW): Hardcoded absolute paths to a specific user's home directory are present in script shebangs (#!/Users/phaedrus/...), exposing local system information and creating environment dependencies.

nano-banana