Executive brief
prompts.chat, a platform for sharing AI prompts and skills, was found to have a security flaw in how it handles "skill" files. An attacker could create a malicious skill that, when downloaded and extracted by a user, writes dangerous files to the user's computer. This could allow the attacker to take control of the victim's system by overwriting critical startup files.
Technical details
A path traversal vulnerability (Zip Slip) exists in prompts.chat due to missing server-side validation of filenames within 'skill' archives. While client-side validation was present, the server-side endpoints (including MCP and API routes) failed to sanitize filenames containing '../' sequences. An attacker can inject these sequences into skill files; when a victim downloads and extracts the resulting ZIP archive using a vulnerable tool, files can be written outside the intended directory. This can be escalated to remote code execution (RCE) by overwriting shell initialization files like .bashrc or .zshrc. The issue was addressed in commit 0f8d4c3 by implementing filename sanitization during the ZIP generation process.
Affected products
- fka prompts.chat prior to commit 0f8d4c3
Timeline
- 2026-03-25: disclosed: Vulnerability reported to vendor
- 2026-03-29: patched: Fix merged into main branch
- 2026-04-03: advisory: CVE published