Add-Skill on Aonan Guanhttps://oddguan.com/tags/add-skill/Recent content in Add-Skill on Aonan GuanAonan Guanhttps://oddguan.com/avatar.webphttps://oddguan.com/avatar.webpHugo -- 0.147.7en-usSun, 08 Mar 2026 00:00:00 +0000Agent SkillSlip: Path Traversal in Google Gemini CLI, Anthropic Claude Code, and Vercel add-skillhttps://oddguan.com/blog/agent-skillslip-google-gemini-cli-anthropic-claude-code-vercel-add-skill-path-traversal/Sun, 08 Mar 2026 00:00:00 +0000https://oddguan.com/blog/agent-skillslip-google-gemini-cli-anthropic-claude-code-vercel-add-skill-path-traversal/Google Gemini CLI, Anthropic Claude Code, and Vercel add-skill share the same path traversal flaw: the name field in skill metadata is passed to path.join() without validation, enabling VS Code hijacking and SSH key injection — invisible to the user.