Affected: MervinPraison PraisonAIAgents

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by accepting an unrestricted skill_path parameter. Unlike file_tools.read_file which enforces workspace boundary confinement, and unlike run_skill_script which requires critical-level approval, read_skill_file has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt. This vulnerability is fixed in 1.5.128.

Affected: PyPI: praisonaiagents

## Summary

`read_skill_file()` in `skill_tools.py` allows reading arbitrary files from the filesystem by accepting an unrestricted `skill_path` parameter. Unlike `file_tools.read_file` which enforces workspace boundary confinement, and unlike `run_skill_script` which requires critical-level approval, `read_skill_file` has neither protection. An agent influenced by prompt injection can exfiltrate sensitive files without triggering any approval prompt.

## Details

The vulnerability is a missing authorization check in `read_skill_file()` at `src/praisonai-agents/praisonaiagents/tools/skill_tools.py:128`.

The function's path validation on line 163 only ensures `file_path` doesn't escape `skill_path` via directory traversal:

```python # skill_tools.py:128-170 def read_skill_file(self, skill_path: str, file_path: str, encoding: str = 'utf-8') -> str: # ... skill_path = os.path.expanduser(skill_path) # line 147 if not os.path.isabs(skill_path): skill_path = os.path.join(self._working_directory, skill_path) skill_path = os.path.abspath(skill_path) # line 150

# ... existence checks ...

full_path = os.path.join(skill_path, file_path) # line 159 full_path = os.path.abspath(full_path) # line 160

# Security check: ensure file is within skill directory if not full_path.startswith(skill_path): # line 163 return f"Error: Path traversal detected..."

with open(full_path, 'r', encoding=encodin…