What
The path that downloads a session's skills now checks the archive before unpacking it, so a malicious or malformed bundle cannot write outside the skills directory.
Details
- Zip versus tar is detected by magic bytes rather than filename.
- The archive is listed first and refused outright if any member has an absolute path or a
..component, or is a symlink, hardlink or device entry. - Extraction goes to a staging directory, and a skill whose name would resolve outside the
skillsdirectory is refused. - The skill version must resolve to a concrete numeric version before the download starts.
- Reached only through the environment worker's skill setup.
Evidence
refusing to extract archive with symlink/hardlink/device member
Strings lifted out of the shipped bundle, so the claim above can be checked against them.