Agent SkillSlip: Path Traversal in Google Gemini CLI, Anthropic Claude Code, and Vercel add-skill

Google Gemini CLI, Anthropic Claude Code, and Vercel add-skill share the same path traversal flaw: the name field in skill metadata is passed to path.join() without validation, enabling VS Code hijacking and SSH key injection — invisible to the user.