The Agent Skills Directory

Command Execution (HIGH): The scripts/restore.sh script is vulnerable to path traversal. The directories arguments are used to construct the TARGET_PATH (e.g., $TARGET_DIR/$dir) without validation. By providing paths like ../../, an attacker could overwrite critical files such as ~/.ssh/authorized_keys or ~/.bashrc. Evidence in scripts/restore.sh: TARGET_PATH="$TARGET_DIR/$dir" followed by cp -rf "$SOURCE_PATH/"* "$TARGET_PATH/".
Indirect Prompt Injection (LOW): The skill is designed to ingest and restore configuration files, including skills and commands, into the agent's active environment (~/.claude/).
1. Ingestion points: User-specified source directories (e.g., /tmp/backup).
1. Boundary markers: Absent; the script blindly copies files.
1. Capability inventory: File write (cp, rsync) to the agent's configuration directory.
1. Sanitization: Absent; content of restored files is not validated before being placed into the agent's execution path.

config-restore