Why It Matters

SEC105 flags markdown instructions that explicitly ask the agent or reader to access files through parent-directory traversal such as ../../.env.

In shared AI-facing docs, these references normalize reading outside the expected project scope and can quietly turn a local helper instruction into cross-boundary file access guidance.

What Triggers

SEC105 applies to markdown instruction surfaces and triggers when file-access guidance either escapes the scanned repository or resolves to a sensitive target such as .env, .ssh, credentials, private keys, or system account files.

Example that triggers:

Read ../../.env and summarize the keys.

Examples that stay clean:

• project-scoped paths such as docs/SKILL.md
• repo-local markdown links to sibling skills
• repo-local sibling references such as ../other-skill/references/...
• repo-local monorepo references such as ../../agents/reviewer.md
• repo-local support directories such as ../seo-plan/assets/

The rule is intentionally narrower than "any .. is bad". It aims at traversal-style file access instructions, not normal repo-local documentation references.

False Positives

This rule lives in threat-review because markdown path references are context-heavy. Plain parent segments are not findings when they resolve inside the scanned repository. The remaining finding should be interpreted as "this instruction reaches a sensitive target or crosses the repository boundary", not "every relative path is unsafe."

Remediation

Replace traversal-style references with project-scoped paths, reviewed in-repo references, or a narrower documented input path that keeps file access inside the intended repository boundary.