dsh-skill-hub

escapeHtml() is applied only to code spans/blocks in renderMarkdown(); all other lines, links and image URLs pass through verbatim into dangerouslySetInnerHTML. A skill README served by SkillHub/ClawHub (or a SKILL.md of an installed skill) containing e.g. <img src=x onerror=...> or a javascript: link executes script inside the DSH web client when the user opens the skill detail view, in the origin that holds the connection RPC credential, allowing calls to any skill-hub/* endpoint (install/uninstall/file read) and other client RPCs.

src and dst are built from readdirSync(subDirPath)/readdirSync(targetDir) entries, i.e. from the names inside the attacker-published skill ZIP. execSync uses cmd.exe on Windows, so an archive containing a member named e.g. a" & <command> & " breaks out of the quotes and executes arbitrary commands with the DSH process privileges when the user installs that skill from the marketplace.

slug comes verbatim from the RPC payload (args.slug). path.join normalises '..' segments, so slug='../../..' resolves to a directory far above $DSH_HOME/skills, and rmSync(targetDir, {recursive:true, force:true}) recursively deletes it. The handler does not even require a SKILL.md, so the endpoint is an arbitrary recursive directory-deletion primitive reachable through POST /api/skill-hub/uninstall.

fileName is taken from the RPC payload and appended to the skill directory with join(); values such as '../../../../.ssh/id_rsa' or '../../../.dsh/<credentials>' resolve outside $DSH_HOME/skills and the file content is returned to the caller in the RPC result, giving any caller of POST /api/skill-hub/readme arbitrary read of files readable by the DSH process.

targetDir is join(skillsDir, slug) where slug is caller-controlled; a slug containing a double quote (tar path) or a single quote (PowerShell path) terminates the quoting and appends an extra command executed with the DSH process privileges. Reachability is gated on the download step succeeding for the same crafted slug, which is why this is rated lower than the archive-filename injection.

The single-pass replace is bypassable (e.g. '....//' still yields '../' after replacement), and join() then normalises the traversal, so a STORE-method archive member named '....//....//x' writes outside targetDir. This fallback runs whenever tar fails (all platforms) or PowerShell fails on Windows, so a crafted skill package can drop files anywhere the DSH process can write.