skill-creator

Insecure File Handling via local-llm-review

scripts/test_package_skill.py

The test script creates temporary directories and files without proper sanitization or security checks, which could be exploited if not properly managed.

Insecure File Packaging via local-llm-review

scripts/package_skill.py

The `package_skill` function creates a distributable `.skill` file without explicit checks for malicious content in the skill folder, potentially allowing the inclusion of harmful files.

Insecure Module Loading via local-llm-review

scripts/test_package_skill.py

The test script dynamically loads modules using `types.ModuleType` and manipulates `sys.modules`, which could be exploited for module hijacking or injection attacks.

Insecure Validation via local-llm-review

scripts/quick_validate.py

The `_parse_simple_frontmatter` function uses a minimal parser for YAML frontmatter, which may not handle all edge cases securely and could be vulnerable to injection attacks.