Summary
When skilleton install checks out a skill from a git repository, it copies the worktree content into .skilleton/skills/<name> using fs.cp with dereference: false. Git stores symlinks as first-class objects (mode 120000), so a skill repo can commit symlinks pointing anywhere on the filesystem. After git worktree add materializes them and fs.cp copies them verbatim, the installed skill contains live symlinks that escape the skill directory.
The existing path-traversal guard (resolveSafeSubPath) only validates the subPath argument string - it never inspects entries inside the worktree.
Impact
An attacker who controls a skill repository can plant symlinks to arbitrary files on the victim's machine (e.g. ~/.ssh/id_rsa, ~/.aws/credentials, or a directory symlink covering the entire home directory). Because Skilleton creates per-agent symlinks into the skill directory and AI agents read that directory, the agent will follow the planted symlinks and can be instructed via SKILL.md to exfiltrate the content.
No privileges required on the victim's side - the only precondition is installing the skill. In automated/CI setups where installs run without user interaction, the score rises to 7.5.
This is a residual of GHSA-5g3j-89fr-r2vp, which did not cover symlinks in worktree content.
Fix (0.3.2)
exportPath now walks the source tree before calling fs.cp. Any symlink whose resolved target escapes the skill root causes the install to abort with an error. The check uses lstat (does not follow links) and readlink through the injected FileSystem interface, so it is fully covered by unit tests.
Workaround
None, short of not installing skills from untrusted repositories. Upgrade to 0.3.2.
EchoSkorJjj Finder
Summary
When
skilleton installchecks out a skill from a git repository, it copies the worktree content into.skilleton/skills/<name>usingfs.cpwithdereference: false. Git stores symlinks as first-class objects (mode120000), so a skill repo can commit symlinks pointing anywhere on the filesystem. Aftergit worktree addmaterializes them andfs.cpcopies them verbatim, the installed skill contains live symlinks that escape the skill directory.The existing path-traversal guard (
resolveSafeSubPath) only validates thesubPathargument string - it never inspects entries inside the worktree.Impact
An attacker who controls a skill repository can plant symlinks to arbitrary files on the victim's machine (e.g.
~/.ssh/id_rsa,~/.aws/credentials, or a directory symlink covering the entire home directory). Because Skilleton creates per-agent symlinks into the skill directory and AI agents read that directory, the agent will follow the planted symlinks and can be instructed viaSKILL.mdto exfiltrate the content.No privileges required on the victim's side - the only precondition is installing the skill. In automated/CI setups where installs run without user interaction, the score rises to 7.5.
This is a residual of GHSA-5g3j-89fr-r2vp, which did not cover symlinks in worktree content.
Fix (0.3.2)
exportPathnow walks the source tree before callingfs.cp. Any symlink whose resolved target escapes the skill root causes the install to abort with an error. The check useslstat(does not follow links) andreadlinkthrough the injectedFileSysteminterface, so it is fully covered by unit tests.Workaround
None, short of not installing skills from untrusted repositories. Upgrade to 0.3.2.