The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/fetch_sources.sh is vulnerable to path traversal.\n
Evidence: The script extracts the filepath variable from JSON responses provided by external APIs (Sourcify and Etherscan). This value is used directly to define the target path (target="${OUT_DIR}/${filepath}") for file writing operations via printf.\n
Impact: An attacker who controls the response from these services (e.g., by deploying a contract with specific metadata) could provide a path containing directory traversal sequences (like ../). This allows the script to write contents to arbitrary locations on the filesystem, potentially overwriting critical system files or user configurations.\n- [EXTERNAL_DOWNLOADS]: The skill fetches smart contract source code from sourcify.dev and api.etherscan.io via curl.\n
Evidence: Use of curl to access Sourcify and Etherscan endpoints in scripts/fetch_sources.sh.\n
Context: These are well-known services within the Ethereum development ecosystem used for contract verification.

fetch-source