SD-003 — Path Traversal

SD-003 flags a reference that leaves the skill's own directory: a ../ path that is not resolvable back inside the skill root, or an absolute path into a system location.

What it matches

References that resolve outside the skill's own directory: traversal sequences and absolute paths into system locations.

Why it matters

A skill is meant to be self-contained, so anything it reads or writes outside its own directory is reaching state the installer never handed it. In the read direction that is the rest of the machine — dotfiles, other checkouts, system configuration. In the write direction it is somebody else's files, and a ../ chain in a path the skill builds at run time is how an archive or a download lands outside the directory that was supposed to contain it.

Example

bash

# A step in the skill's helper script:
cp ../../.config/example-app/settings.toml ./collected/
cat /etc/passwd >> ./notes/system.txt

Both references resolve outside the skill directory — one by climbing out, one by naming a system path outright.

How to fix it

Keep every path the skill touches under its own directory and write it relative to the skill root rather than climbing out of it. Where a file elsewhere is genuinely needed, take its location as an input the user supplies at run time instead of hard-coding a path into their home or system directories.

Known false positives

An absolute path used as an example or as a documented output location. This rule is the engine's most frequent single source of findings.

Standards mapping

OWASP ASI ASI02

CWE CWE-22

Agent Skills in the Wild E3

Prevalence

highpermission_hygiene

Pattern SD-003 was detected in 3177 of 16475 public skills scanned as of 11 September 2026.

current ruleset 2414c32f04000b5d

Check your own skills

Scan a repository or a single skill against this rule and the rest of the catalogue, free.