skillscript

Safe, reusable automation authored by agents. skillscript.ai • docs TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. See Quickstart. What is Skillscript? Skillscript came from asking: what would a Makefile look like if it built skills instead of binaries? The...

CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54520 GHSA| GHSA-cm8g-8jfq-887p Project|...

CVE-2026-54519

CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...

CVE-2026-54520

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54519

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

EUVD-2026-82580

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54519 AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54519

AI Agent Automation (npm package backend, repo vmDeshpande/ai-agent-automation) had missing ownership checks in backend/src/controllers/memory.controller.js. The functions listMemories, deleteMemory, and clearAgentMemory accepted a caller-supplied agentId or memory _id without verifying that the ...

CVE-2026-54519 AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54519 AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54520

AI Agent Automation (vmDeshpande/ai-agent-automation), a modular AI agent workflow automation platform, is affected by a path traversal vulnerability (CWE-22) in the file-step implementation of backend/src/agents/executor.js. Prior to v0.9.1 , the user-controlled step.path value is resolved via p...

EUVD-2026-82577

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54519: Missing Authorization

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...

CVE-2026-54520: Improper Limitation of a Pathname to a Restricted Directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

PT-2026-95148

Name of the Vulnerable Software and Affected Versions AI Agent Automation versions prior to 0.9.1 Description An issue exists in the backend/src/controllers/memory.controller.js file where requests are authenticated, but the listMemories, deleteMemory, and clearAgentMemory functions fail to verif...

PT-2026-95149

Name of the Vulnerable Software and Affected Versions AI Agent Automation versions prior to 0.9.1 Description An authenticated user capable of creating or modifying workflow file steps can exploit a path traversal flaw in the executeStep file-step implementation located in...

skillscript v0.40.1

Safe, reusable automation authored by agents. skillscript.ai • docs TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. See Quickstart. What is Skillscript? Skillscript came from asking: what would a Makefile look like if it built skills instead of binaries? The...