audit-code

The `SKILL_NAME` variable, derived directly from user input via the `--skill-name` argument, is used to construct a destination path (`dest="$root/$SKILL_NAME"`) without proper sanitization for path separators or traversal sequences (e.g., `../`). This allows an attacker to specify a skill name like `../../.ssh` or `foo/bar`. This malicious input is then used in critical shell commands: 1. `rm -rf "$dest"`: An attacker could delete arbitrary directories or files within the user's home directory (e.g., `rm -rf $HOME/.ssh`). 2. `ln -s "$SOURCE_DIR" "$dest"`: An attacker could create a symlink from `$SOURCE_DIR` to an arbitrary location (e.g., `$HOME/.ssh`), potentially replacing critical user directories with a symlink to the skill's source. 3. `mkdir -p "$dest"`: An attacker could create arbitrary directory structures. 4. `rsync -a --delete "$SOURCE_DIR/" "$dest/"`: An attacker could copy the entire skill content into an arbitrary directory (e.g., `$HOME/.ssh`), potentially overwriting or introducing malicious content into sensitive configuration files (like `authorized_keys`). The `agent_root` function correctly restricts the base path to known agent skill directories within `$HOME`, but the lack of sanitization for `SKILL_NAME` allows traversal *outside* these specific skill directories within the user's home directory.