@rhize/skill-forge 0.6.0 → 0.6.1

package/README.md

@@ -161,13 +161,15 @@ guessing between the two).
 |---|---|---|
 | Local directory | `./my-mcp-server` | Copied into quarantine, same as a local skill source. |
 | Git URL | `https://github.com/owner/mcp-server.git` | Shallow-cloned into quarantine, same as a git skill source. |
-| npm package | `@scope/name` or `some-mcp-server` | `npm pack <name> --pack-destination <quarantine>`, then tarball **extraction only** — never `npm install`, never lifecycle scripts. |
+| npm package | `@scope/name` or `some-mcp-server` | `npm pack <name> --ignore-scripts --pack-destination <quarantine>`, then tarball **extraction only** — never `npm install`, never lifecycle scripts. Every tarball member path is validated (absolute paths and `..` segments are rejected) before extraction. |
 
 **What's gated**
 
 Safety runs the same built-in deny-pattern ruleset used for skills (curl\|bash, credential-file
-access, etc.) plus MCP-specific rules: inline credential values in config/env, unpinned `npx -y`
-launch commands, `--dangerously-*`/`--no-sandbox` flags, and filesystem-root launch args — see the
+access, etc.) plus MCP-specific rules: inline credential values in config/env (quoted or
+unquoted), unpinned `npx -y` launch commands (a moving/dist tag like `@latest` counts as
+unpinned, and `npx` is recognized by basename so a full path or `npx.cmd` can't evade it),
+`--dangerously-*`/`--no-sandbox` flags, and filesystem-root launch args — see the
 [MCP safety ruleset table](docs/gate-policy.md#mcp-safety-ruleset). Overlap analysis (Pro, free
 during the 0.x beta) ranks the candidate against the server entries already present in your
 configured `mcpTargets` files, instead of against a skills root.
@@ -266,6 +268,11 @@ implementation status.
 - **Block on HIGH/CRITICAL.** Any finding at `HIGH` or `CRITICAL` severity blocks the candidate
   outright (verdict `block`); a lower-severity finding produces `warn`; a clean scan is `pass`.
   `--yes` honors this: `block` is rejected automatically.
+- **npm-sourced MCP candidates: `--ignore-scripts` + tarball member validation.** An npm-package
+  MCP source is fetched with `npm pack --ignore-scripts`, and the tarball's member list is checked
+  with `tar -tzf` before extraction — any absolute path or `..` path segment refuses the extract
+  with an error instead of running `tar -xzf` (a path-traversal guard against a malicious tarball
+  writing outside the quarantine sandbox).
 - **SkillSpector, when installed.** If [SkillSpector](https://github.com/NVIDIA/SkillSpector)
   (Apache-2.0) is on `PATH`, skill-forge shells out to it (`--no-llm` by default, so scanned skill
   content is never sent to an external LLM provider) and merges its findings into the same report.