You'll notice
Useful3 Signal3
Downloaded skill archives are checked before unpacking so they cannot write outside the skills folder.
What's wrong with this entry?
Anonymous. No account, no email.
What
The path that downloads a session's skills now checks the archive before unpacking it, so a malicious or malformed bundle cannot write outside the skills directory.
Details
- Zip versus tar is detected by magic bytes rather than filename.
- The archive is listed first and refused outright if any member has an absolute path or a
..component, or is a symlink, hardlink or device entry. - Extraction goes to a staging directory, and a skill whose name would resolve outside the
skillsdirectory is refused. - The skill version must resolve to a concrete numeric version before the download starts.
- Reached only through the environment worker's skill setup.
Evidence
refusing to extract archive with symlink/hardlink/device member
Strings lifted out of the shipped bundle, so the claim above can be checked against them.