@almyty/skills 1.0.15 → 1.2.0

package/README.md

@@ -116,10 +116,14 @@ Create `.almytyrc` in your project or home directory:
 
 Requires `npx @almyty/auth login` first. Reads credentials from `~/.almyty/credentials.json`.
 
-## Docs
+## About almyty
 
-https://almyty.com/docs
+almyty is the full-stack platform for AI agents, agnostic by design: any LLM, any
+API turned into tools, served over MCP, A2A, UTCP, and Agent Skills. Open source,
+no lock-in.
 
-## License
+- Website — https://almyty.com
+- Docs — https://docs.almyty.com
+- Source — https://github.com/almyty-inc/almyty
 
-BSL-1.1
+Apache-2.0 © Almyty Inc.

package/dist/installer.js

@@ -10,12 +10,36 @@
  * already present in every SKILL.md we generate.
  */
 import { writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { join, resolve, sep } from 'path';
 /** Legacy prefix from <=v1.0.9 — older installs still use this dir
  *  name. Kept here so `remove`/`installed` continue to find them. */
 const LEGACY_SKILL_PREFIX = 'almyty-';
 /** Marker line we expect inside every SKILL.md frontmatter we wrote. */
 const ALMYTY_MARKER = /^\s*author:\s*almyty\s*$/m;
+/**
+ * Skill names come from the backend/gateway and are used to build
+ * filesystem paths under skillsDir. A malicious or compromised gateway
+ * could return `name: "../../../.ssh/authorized_keys"` and have the
+ * installer write — or, via the legacy-dir cleanup, recursively delete —
+ * arbitrary files on the user's machine (and the daemon/watch modes do
+ * this automatically on a timer). Restrict names to a single safe path
+ * segment.
+ */
+const SAFE_SKILL_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function isSafeSkillName(name) {
+    return (typeof name === 'string' &&
+        name !== '.' &&
+        name !== '..' &&
+        !name.includes('/') &&
+        !name.includes('\\') &&
+        SAFE_SKILL_NAME.test(name));
+}
+/** Defence in depth: assert a built path stays inside skillsDir. */
+function isInside(baseDir, candidate) {
+    const base = resolve(baseDir);
+    const target = resolve(candidate);
+    return target === base || target.startsWith(base + sep);
+}
 /**
  * Strip the legacy `name: almyty-<x>` line in the SKILL.md frontmatter
  * to `name: <x>` so the agent-visible identifier is the skill's own
@@ -51,6 +75,13 @@ export function installSkills(skills, target) {
     const files = [];
     mkdirSync(target.skillsDir, { recursive: true });
     for (const skill of skills) {
+        // Reject backend-supplied names that aren't a single safe path
+        // segment — skip rather than throw so one bad entry can't break the
+        // whole install (e.g. in daemon/watch mode).
+        if (!isSafeSkillName(skill.name)) {
+            console.warn(`Skipping skill with unsafe name: ${JSON.stringify(skill.name)}`);
+            continue;
+        }
         const dirName = skill.name;
         const skillDir = join(target.skillsDir, dirName);
         const skillFile = join(skillDir, 'SKILL.md');
@@ -58,6 +89,11 @@ export function installSkills(skills, target) {
         // shape, remove it before writing the new shape so the agent
         // doesn't see two copies of the same skill.
         const legacyDir = join(target.skillsDir, `${LEGACY_SKILL_PREFIX}${skill.name}`);
+        // Containment guard (defence in depth) before any write/delete.
+        if (!isInside(target.skillsDir, skillDir) || !isInside(target.skillsDir, legacyDir)) {
+            console.warn(`Skipping skill whose path escapes the skills directory: ${skill.name}`);
+            continue;
+        }
         if (legacyDir !== skillDir && existsSync(legacyDir)) {
             rmSync(legacyDir, { recursive: true, force: true });
         }

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@almyty/skills",
-  "version": "1.0.15",
-  "description": "Install API skills into AI coding agents — Claude Code, Cursor, Windsurf, Copilot, Codex",
+  "version": "1.2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "Install any API as a skill into Claude Code, Cursor, Windsurf, Copilot, or Codex \u2014 almyty turns OpenAPI and GraphQL into agent-ready skills.",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -30,9 +33,9 @@
     "almyty"
   ],
   "author": "almyty",
-  "license": "BSL-1.1",
+  "license": "Apache-2.0",
   "dependencies": {
-    "@almyty/client": "^0.1.0",
+    "@almyty/client": "^1.2.0",
     "@clack/prompts": "^1.2.0"
   },
   "devDependencies": {
@@ -40,5 +43,14 @@
     "tsx": "^4.7.0",
     "typescript": "^5.3.0",
     "vitest": "^4.1.0"
+  },
+  "homepage": "https://almyty.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/almyty-inc/almyty.git",
+    "directory": "packages/skills-cli"
+  },
+  "bugs": {
+    "url": "https://github.com/almyty-inc/almyty/issues"
   }
 }

package/dist/__tests__/client.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/__tests__/client.test.js

@@ -1,145 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { parseRef } from '../client.js';
-import { generateMetaSkill } from '../meta-skill.js';
-import { loadConfig } from '../config.js';
-// ---------------------------------------------------------------------------
-// parseRef()
-// ---------------------------------------------------------------------------
-describe('parseRef', () => {
-    it('parses @org/gateway as a gateway ref', () => {
-        const result = parseRef('@org/gateway');
-        expect(result).toEqual({
-            type: 'gateway',
-            orgSlug: 'org',
-            gatewaySlug: 'gateway',
-            raw: '@org/gateway',
-        });
-    });
-    it('parses @org/gateway/skill as a skill ref', () => {
-        const result = parseRef('@org/gateway/skill');
-        expect(result).toEqual({
-            type: 'skill',
-            orgSlug: 'org',
-            gatewaySlug: 'gateway',
-            skillName: 'skill',
-            raw: '@org/gateway/skill',
-        });
-    });
-    it('parses a UUID string as a uuid ref', () => {
-        const uuid = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890';
-        const result = parseRef(uuid);
-        expect(result).toEqual({
-            type: 'uuid',
-            uuid,
-            raw: uuid,
-        });
-    });
-    it('parses uppercase UUID correctly', () => {
-        const uuid = 'A1B2C3D4-E5F6-7890-ABCD-EF1234567890';
-        const result = parseRef(uuid);
-        expect(result.type).toBe('uuid');
-        expect(result.uuid).toBe(uuid);
-    });
-    it('returns search for a random string', () => {
-        const result = parseRef('some-random-query');
-        expect(result).toEqual({
-            type: 'search',
-            raw: 'some-random-query',
-        });
-    });
-    it('returns search for an empty string', () => {
-        const result = parseRef('');
-        expect(result).toEqual({
-            type: 'search',
-            raw: '',
-        });
-    });
-    it('returns search for @ with only one segment', () => {
-        const result = parseRef('@org');
-        expect(result).toEqual({
-            type: 'search',
-            raw: '@org',
-        });
-    });
-    it('returns search for @ with more than three segments', () => {
-        const result = parseRef('@org/gw/skill/extra');
-        expect(result).toEqual({
-            type: 'search',
-            raw: '@org/gw/skill/extra',
-        });
-    });
-});
-// ---------------------------------------------------------------------------
-// generateMetaSkill()
-// ---------------------------------------------------------------------------
-describe('generateMetaSkill', () => {
-    it('returns a SkillFile with name "skills" and fileName "almyty-skills"', () => {
-        const skill = generateMetaSkill();
-        expect(skill.name).toBe('skills');
-        expect(skill.fileName).toBe('almyty-skills');
-    });
-    it('content includes npx @almyty/skills commands', () => {
-        const { content } = generateMetaSkill();
-        expect(content).toContain('npx @almyty/skills');
-    });
-    it('content references daemon command', () => {
-        const { content } = generateMetaSkill();
-        expect(content).toContain('daemon');
-    });
-    it('content references search command', () => {
-        const { content } = generateMetaSkill();
-        expect(content).toContain('search');
-    });
-    it('content references install command', () => {
-        const { content } = generateMetaSkill();
-        expect(content).toContain('install');
-    });
-    it('content references run command', () => {
-        const { content } = generateMetaSkill();
-        expect(content).toContain('run');
-    });
-    it('content includes SKILL.md front-matter', () => {
-        const { content } = generateMetaSkill();
-        expect(content).toContain('---');
-        expect(content).toContain('name: almyty-skills');
-        expect(content).toContain('description:');
-    });
-});
-// ---------------------------------------------------------------------------
-// loadConfig()
-// ---------------------------------------------------------------------------
-describe('loadConfig', () => {
-    const originalEnv = process.env;
-    beforeEach(() => {
-        // Reset env between tests
-        process.env = { ...originalEnv };
-        delete process.env.APIFAI_SKILLS_DIR;
-    });
-    afterEach(() => {
-        process.env = originalEnv;
-        vi.restoreAllMocks();
-    });
-    it('returns empty config when no .almytyrc exists and no env var', () => {
-        // Use a temp directory that definitely has no .almytyrc
-        const config = loadConfig('/tmp/nonexistent-dir-' + Date.now());
-        expect(config).toEqual({});
-    });
-    it('uses APIFAI_SKILLS_DIR env var when set', () => {
-        process.env.APIFAI_SKILLS_DIR = '/custom/skills/dir';
-        const config = loadConfig();
-        expect(config).toEqual({ skillsDir: '/custom/skills/dir' });
-    });
-    it('env var takes precedence over .almytyrc files', () => {
-        process.env.APIFAI_SKILLS_DIR = '/env/override';
-        // Even if we pass a projectDir, env should take priority
-        const config = loadConfig('/some/project');
-        expect(config.skillsDir).toBe('/env/override');
-    });
-    it('returns empty config for a directory with no rc file and no home rc', () => {
-        // Use a deeply nested temp path that certainly has no .almytyrc anywhere
-        // and also won't match ~/.almytyrc (already handled by the missing file)
-        const fakePath = `/tmp/almyty-test-${Date.now()}/deeply/nested/project`;
-        const config = loadConfig(fakePath);
-        expect(config).toEqual({});
-    });
-});