{"version":"2.1.227","anchor":"skills-sync-now-refuses-damaged-or-hostile-skill-packages","canonical_anchor":"skills-sync-now-refuses-damaged-or-hostile-skill-packages","heading":"Skills sync now refuses damaged or hostile skill packages","tier":"notice","area":"Skills","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227\/e\/skills-sync-now-refuses-damaged-or-hostile-skill-packages","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.227","markdown":"### Skills sync now refuses damaged or hostile skill packages\n\nSkill syncing now rejects broken or repo-shaped skill archives and repairs a symlinked skills folder.\n\n**What**\n\nThe background sync that installs skills was reworked to survive bad downloads and crashed runs. A downloaded skill archive is rejected if it has no usable `SKILL.md` or if it looks like a git repository, and if the folder skills sync into turns out to be a symlink it is deleted and recreated.\n\n**Details**\n\n- New log entries: `skills_sync_extracted_zip_unusable` for a rejected archive, `skills_sync_root_symlink_removed` for the symlinked root, and a hard error \"synced skills root is not a directory\" if it cannot be made one.\n- Directories that cannot be deleted are moved to a trash directory instead of blocking the sync.\n- The record of installed skills gained lists of stale directories and pending claims; a claim carries the owning process id and its start time, so a half-installed directory left by a crashed run is reclaimed by the next one.\n- An older record layout is migrated or repaired at startup, logged as `skills_sync_legacy_layout_migrated` and `skills_sync_legacy_manifest_repaired`.\n\n**Evidence**\n\n`skills_sync_extracted_zip_unusable`\n\n- Area: Skills\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}