The Agent Skills Directory

Indirect Prompt Injection (HIGH): The skill possesses a high-risk attack surface because it reads external content and has write capabilities. • Ingestion points: fs.readFile and fs.glob ingest untrusted data from the filesystem. • Boundary markers: None specified in the skill definition to differentiate between file content and instructions. • Capability inventory: fs.writeFile and fs.applyPatch allow for permanent modification of the environment. • Sanitization: Absent. An attacker could place instructions inside a file that, when read, cause the agent to execute unauthorized file writes or exfiltration.
Data Exposure & Command Execution (MEDIUM): While restricted to the workspace, fs.readFile can be used to access sensitive project data (e.g., .env files, git configs). The fs.writeFile and fs.applyPatch commands provide the primitives needed to modify application logic or inject malicious scripts into the project structure.

filesystem