The Agent Skills Directory

COMMAND_EXECUTION (MEDIUM): The utility script scripts/create-space.sh is vulnerable to shell command injection. Positional arguments for the bucket name and region are interpolated directly into the s3cmd command without sanitization or proper shell quoting, which could allow an attacker to execute arbitrary commands if the agent passes unvalidated user input to the script.
DATA_EXFILTRATION (LOW): The skill facilitates data transfer to a non-whitelisted domain (digitaloceanspaces.com). Several code snippets default to public-read ACLs, and the provided templates/cors.xml allows all origins (*), both of which significantly increase the risk of accidental data exposure. Note: The automated scanner alert for file.co appears to be a false positive triggered by the string file.content_type in the integration code.
PROMPT_INJECTION (LOW): The skill implements functions for downloading and listing external objects, creating an indirect prompt injection surface.
Ingestion points: downloadFile (Node.js) and download_file (Python) functions in SKILL.md retrieve external data into the agent context.
Boundary markers: None present; the code does not include delimiters or instructions to prevent the agent from following commands embedded in the retrieved files.
Capability inventory: The skill provides comprehensive storage capabilities, including the ability to list, read, write, and delete objects.
Sanitization: None; there is no validation or escaping of the content of downloaded objects before they are processed by the agent.

spaces-storage