The read_skill_file() function in PraisonAIAgents accepts a skill_path parameter without any restriction. Unlike other file access helpers, it does not enforce a workspace boundary or require an approval gate. As a result, an attacker who can influence an agent’s prompt can supply a crafted path and exfiltrate arbitrary files from the host filesystem. This flaw leads to a confidentiality breach but does not directly impact availability or integrity of the system.

The vulnerability affects the PraisonAIAgents product by MervinPraison. All instances running a version earlier than 1.5.128 are susceptible to arbitrary file reads through the unprotected read_skill_file() routine.

The CVSS score of 6.2 indicates moderate severity. The EPSS score is not available, so the current exploit probability is unclear. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the flaw requires an attacker to inject a prompt that reaches the agent, the attack vector is likely local or within an environment where prompt injection is possible; it is inferred that remote exploitation would depend on additional interfaces that accept untrusted prompts.