@klhapp/skillmux 1.9.0 → 1.9.1

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.1](https://github.com/klhq/skillmux/compare/v1.9.0...v1.9.1) (2026-08-30)
+
+
+### Fixed
+
+* **install:** reject '.' / '..' skill ids derived during install (path traversal) ([#151](https://github.com/klhq/skillmux/issues/151)) ([2426613](https://github.com/klhq/skillmux/commit/2426613b79c67e2afa267de946492b6b020011bb))
+* **install:** reject scp-like git URLs starting with '-' (argument injection RCE) ([#148](https://github.com/klhq/skillmux/issues/148)) ([6a9db28](https://github.com/klhq/skillmux/commit/6a9db28670201237dd17455592fa30cbce43b58f))
+* **sync:** require approval before creating a new target directory ([#152](https://github.com/klhq/skillmux/issues/152)) ([6fcfd1a](https://github.com/klhq/skillmux/commit/6fcfd1a8beed87e5f88e2bd24b84a94a3adb3d89))
+* **update:** validate skill-id against SKILL_ID_PATTERN before path-joining it ([#150](https://github.com/klhq/skillmux/issues/150)) ([0bfa807](https://github.com/klhq/skillmux/commit/0bfa8071a80ea4f70b2e6974cb2cb439666f8357))
+
 ## [1.9.0](https://github.com/klhq/skillmux/compare/v1.8.0...v1.9.0) (2026-08-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@klhapp/skillmux",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Skill management and retrieval for AI agents: sync native skills across clients and route the long tail over MCP",
   "type": "module",
   "private": false,

package/src/cli.ts

@@ -82,10 +82,12 @@ import {
 import { getStats, renderStatsText, type StatsResponse } from "./stats";
 import {
   installPostMergeHook,
+  resolveProjectPinDir,
   restoreMonolith as restoreMonolithTarget,
   syncProjectTargets,
   syncTarget,
   writeLocalVaultMarker,
+  type ProjectGroupInput,
 } from "./sync";
 import { scanVault, vaultResolutionOrder } from "./vault";
 
@@ -771,21 +773,45 @@ function parseSyncArgs(args: string[]): {
   dryRun: boolean;
   restoreMonolith: boolean;
   installHook: boolean;
+  yes: boolean;
 } {
   let dryRun = false;
   let restoreMonolith = false;
   let installHook = false;
+  let yes = false;
   for (const arg of args) {
     if (arg === "--dry-run") dryRun = true;
     else if (arg === "--restore-monolith") restoreMonolith = true;
     else if (arg === "--install-hook") installHook = true;
+    else if (arg === "--yes") yes = true;
     else throw new Error(`unknown sync option: ${arg}`);
   }
-  return { dryRun, restoreMonolith, installHook };
+  return { dryRun, restoreMonolith, installHook, yes };
+}
+
+/**
+ * A target directory that doesn't exist yet is about to be created by `sync`.
+ * `manifest.targets[*].dir` is vault content — readable and writable by whatever
+ * populated the vault (a shared git-backed vault pulled in, or a hand-edit) — and
+ * `sync` can run unattended via the `--install-hook` post-merge hook. Without this
+ * gate, a tampered manifest naming a brand-new path gets that directory silently
+ * created (and populated with symlinks) the next time anyone pulls. Creation for
+ * an as-yet-unseen directory therefore requires either `--yes` or an interactive
+ * confirmation; once the directory exists, later syncs never hit this path again.
+ */
+async function confirmNewSyncTarget(label: string, dir: string, yes: boolean): Promise<boolean> {
+  if (yes) return true;
+  if (!isInteractive()) {
+    console.log(
+      `${label}: skipped — ${dir} does not exist yet; creating it requires approval. Re-run "skillmux sync --yes", or run "skillmux sync" interactively, once you've confirmed this target is expected.`,
+    );
+    return false;
+  }
+  return confirmAction(`${label}: create new target directory ${dir}?`);
 }
 
 async function runSync(args: string[]): Promise<void> {
-  const { dryRun, restoreMonolith, installHook } = parseSyncArgs(args);
+  const { dryRun, restoreMonolith, installHook, yes } = parseSyncArgs(args);
   const config = await loadConfig();
   const vaultPath = expandHome(config.vault_path);
 
@@ -829,6 +855,16 @@ async function runSync(args: string[]): Promise<void> {
       continue;
     }
 
+    if (!dryRun && !existsSync(targetDir)) {
+      const approved = await confirmNewSyncTarget(targetName, targetDir, yes);
+      if (!approved) {
+        if (isInteractive()) {
+          console.log(`${targetName}: skipped — creating ${targetDir} was not approved`);
+        }
+        continue;
+      }
+    }
+
     const suffix = dryRun ? " (dry-run)" : "";
     const result = syncTarget(
       {
@@ -851,9 +887,24 @@ async function runSync(args: string[]): Promise<void> {
 
     if (target.project_groups.length > 0) {
       const allGroups = manifest.project ?? {};
-      const projectGroups = Object.fromEntries(
-        target.project_groups.map((name) => [name, allGroups[name]!]),
-      );
+      const projectGroups: Record<string, ProjectGroupInput> = {};
+      for (const groupName of target.project_groups) {
+        const group = allGroups[groupName]!;
+        const approvedPaths: string[] = [];
+        for (const path of group.paths) {
+          // Mirror syncProjectTargets' own `if (!existsSync(path)) continue` so we
+          // never prompt for a project path it would silently skip anyway.
+          if (!existsSync(path)) continue;
+          const pinDir = resolveProjectPinDir(targetDir, path);
+          if (dryRun || existsSync(pinDir)) {
+            approvedPaths.push(path);
+            continue;
+          }
+          const approved = await confirmNewSyncTarget(`${targetName}/${groupName}`, pinDir, yes);
+          if (approved) approvedPaths.push(path);
+        }
+        projectGroups[groupName] = { ...group, paths: approvedPaths };
+      }
       const projectResults = syncProjectTargets(
         { vaultPath, targetDir, targetName, projectGroups, localVaultPaths },
         { dryRun },
@@ -1437,7 +1488,12 @@ async function runInit(
   ) {
     console.log(`\n${printLastMile()}`);
   }
-  if (guided && sync && confirmedTargets.length > 0) await runSync([]);
+  // Reaching this point already required approval above (--yes, or an accepted
+  // confirmAction naming these exact targets/dirs) — that approval covers whatever
+  // new target directories this init just adopted, so runSync's own new-target
+  // confirmation gate would just be a redundant (and non-interactively,
+  // silently-skipping) re-ask.
+  if (guided && sync && confirmedTargets.length > 0) await runSync(["--yes"]);
 }
 
 function parseReportArgs(args: string[]): {

package/src/commands/project.ts

@@ -397,7 +397,12 @@ export async function runProject(
   writeManifestAtomic(manifestPath, updated);
   if (request.sync) {
     try {
-      await options.sync([]);
+      // Reaching here already required approval above (request.yes, or an
+      // accepted interactive confirmAction) — that approval covers whatever
+      // new target/pin directories this project setup implies, so the
+      // downstream sync's own new-target confirmation gate would just be a
+      // redundant (and, non-interactively, silently-skipping) re-ask.
+      await options.sync(["--yes"]);
     } catch (error) {
       throw new Error(
         `project configuration was saved, but sync failed; fix the reported issue and run "skillmux sync": ${

package/src/commands/update.ts

@@ -14,6 +14,7 @@ import { emitSuccess } from "../output";
 import { hashSkillContent, readSkillOrigin, writeSkillOrigin } from "../provenance";
 import type { SkillOrigin } from "../provenance";
 import { type ScanFinding, type ScanSeverity, scanExitCode } from "../scan";
+import { SKILL_ID_PATTERN } from "../vault";
 import { confirmIfNeeded } from "./shared";
 import { checkOutdated } from "./outdated";
 
@@ -38,6 +39,16 @@ async function resolveCandidateOrigins(
   allowLocalSource: boolean,
 ): Promise<{ skillId: string; origin: SkillOrigin }[]> {
   if (skillId) {
+    // skillId (the CLI's positional <skill-id>) is joined straight into vaultPath
+    // below, and that join ultimately reaches installIntoVault's rmSync(recursive)
+    // + cpSync on the write path — a "../"-shaped value escapes the vault and lets
+    // `skillmux update` delete and overwrite an arbitrary directory on disk. Batch
+    // mode never hits this because checkOutdated only enumerates real vault entries
+    // (already SKILL_ID_PATTERN-filtered); the explicit single-skill path is the
+    // only one that takes this string directly from argv, so validate it here.
+    if (!SKILL_ID_PATTERN.test(skillId)) {
+      throw new Error(`invalid skill id "${skillId}": expected lowercase letters, digits, and hyphens only`);
+    }
     let origin: SkillOrigin | null;
     try {
       origin = readSkillOrigin(join(vaultPath, skillId));

package/src/install.ts

@@ -13,7 +13,14 @@ const GIT_URL_PREFIXES = ["http://", "https://", "git://", "ssh://", "file://"];
 const SCP_LIKE_URL_PATTERN = /^[^/\s]+@[^/\s]+:/;
 
 export function isGitUrl(repo: string): boolean {
-  return GIT_URL_PREFIXES.some((prefix) => repo.startsWith(prefix)) || SCP_LIKE_URL_PATTERN.test(repo);
+  if (GIT_URL_PREFIXES.some((prefix) => repo.startsWith(prefix))) return true;
+  // scp-like syntax (user@host:path) has no URL scheme, so whatever accepts it here
+  // hands the raw string to `git clone`/`git ls-remote` as a bare positional argument.
+  // If that string starts with `-`, git's own option parser reads it as a flag, not a
+  // repository — verified against git 2.55: `--upload-pack=<cmd>@host:path` makes git
+  // run `<cmd>` as a real local shell command instead of contacting a remote. Reject
+  // it outright rather than let a crafted string reach that argv slot.
+  return SCP_LIKE_URL_PATTERN.test(repo) && !repo.startsWith("-");
 }
 
 /** A `file://` source_url reaches the local filesystem directly, not just a network
@@ -170,14 +177,32 @@ export interface ResolvedSkillDir {
   dir: string;
 }
 
+/** The returned skillId is joined straight into vaultPath by installIntoVault's callers
+ *  and fed to a real rmSync(recursive)+cpSync overwrite. Both branches below can produce
+ *  "." or ".." for a crafted-but-plausible input: `skill_path` of "." (e.g. `skillmux
+ *  install owner/repo/.`) survives the ".." segment check since "." isn't "..", and its
+ *  basename is "." too; `fallbackName` comes from deriveRepoName(url), which can return
+ *  ".." for a url whose last "/"- or ":"-delimited segment is literally "..". Verified
+ *  end-to-end against the real CLI binary: the former makes `install --force` wipe the
+ *  entire vault, the latter makes it wipe the vault's parent directory. Neither can ever
+ *  legitimately be a skill id, so reject both outright rather than let them reach a join. */
+function rejectTraversalSkillId(skillId: string): void {
+  if (skillId === "." || skillId === "..") {
+    throw new Error(`invalid skill id "${skillId}"`);
+  }
+}
+
 export function resolveSkillDir(cloneDir: string, fallbackName: string, skillPath?: string): ResolvedSkillDir {
   if (skillPath) {
     if (skillPath.startsWith("/") || skillPath.split("/").includes("..")) {
       throw new Error(`invalid skill_path "${skillPath}": must be a relative path within the repo`);
     }
-    return { skillId: basename(skillPath), dir: join(cloneDir, skillPath) };
+    const skillId = basename(skillPath);
+    rejectTraversalSkillId(skillId);
+    return { skillId, dir: join(cloneDir, skillPath) };
   }
   if (existsSync(join(cloneDir, "SKILL.md"))) {
+    rejectTraversalSkillId(fallbackName);
     return { skillId: fallbackName, dir: cloneDir };
   }
   const discovered = readdirSync(cloneDir, { withFileTypes: true })