@cortask/core 0.2.19 → 0.2.20

package/dist/index.js

@@ -3907,10 +3907,10 @@ async function checkEligibility(skill, credentialStore) {
   return { eligible: true };
 }
 async function isBinaryAvailable(name) {
-  const { exec: exec4 } = await import("child_process");
+  const { exec: exec3 } = await import("child_process");
   const cmd = process.platform === "win32" ? `where ${name}` : `which ${name}`;
   return new Promise((resolve) => {
-    exec4(cmd, (error) => {
+    exec3(cmd, (error) => {
       resolve(!error);
     });
   });
@@ -3963,7 +3963,7 @@ async function readSkillFile(skillsDir, name) {
 }
 
 // src/skills/installer.ts
-import { exec as exec3 } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import fs13 from "fs/promises";
 import path13 from "path";
 async function installSkillFromGit(gitUrl, skillsDir) {
@@ -3972,6 +3972,9 @@ async function installSkillFromGit(gitUrl, skillsDir) {
   if (!repoName) {
     throw new Error(`Invalid git URL: ${gitUrl}`);
   }
+  if (!/^(https?:\/\/|git@[\w.-]+:|ssh:\/\/)/.test(gitUrl)) {
+    throw new Error(`Invalid git URL format: ${gitUrl}`);
+  }
   const targetDir = path13.join(skillsDir, repoName);
   try {
     await fs13.access(targetDir);
@@ -3979,7 +3982,7 @@ async function installSkillFromGit(gitUrl, skillsDir) {
   } catch (err) {
     if (err.message.includes("already installed")) throw err;
   }
-  await execAsync(`git clone --depth 1 "${gitUrl}" "${targetDir}"`);
+  await execFileAsync("git", ["clone", "--depth", "1", gitUrl, targetDir]);
   try {
     await fs13.access(path13.join(targetDir, "SKILL.md"));
   } catch {
@@ -4015,9 +4018,9 @@ async function removeSkill(skillName, skillsDir) {
   clearSkillCache();
   logger.info(`Removed skill "${skillName}"`, "skills");
 }
-function execAsync(command) {
+function execFileAsync(cmd, args) {
   return new Promise((resolve, reject) => {
-    exec3(command, { timeout: 6e4 }, (error, stdout, stderr) => {
+    execFile2(cmd, args, { timeout: 6e4 }, (error, stdout, stderr) => {
       if (error) {
         reject(new Error(stderr || error.message));
         return;
@@ -4233,7 +4236,10 @@ var EncryptedCredentialStore = class {
     if (!this.store) return;
     await fs15.mkdir(path14.dirname(this.filePath), { recursive: true });
     const tmp = `${this.filePath}.${process.pid}.tmp`;
-    await fs15.writeFile(tmp, JSON.stringify(this.store, null, 2), "utf-8");
+    await fs15.writeFile(tmp, JSON.stringify(this.store, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
     await fs15.rename(tmp, this.filePath);
   }
   async get(key) {