claude-code-workflow 6.3.18 → 6.3.20

package/ccw/dist/core/routes/skills-routes.js

@@ -1,7 +1,16 @@
-import { readFileSync, existsSync, readdirSync, statSync, unlinkSync, promises as fsPromises } from 'fs';
+/**
+ * Skills Routes Module
+ * Handles all Skills-related API endpoints
+ */
+import { readFileSync, existsSync, readdirSync, statSync, promises as fsPromises } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
 import { executeCliTool } from '../../tools/cli-executor.js';
+import { SmartContentFormatter } from '../../tools/cli-output-converter.js';
+import { validatePath as validateAllowedPath } from '../../utils/path-validator.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
 // ========== Skills Helper Functions ==========
 /**
  * Parse skill frontmatter (YAML header)
@@ -40,7 +49,11 @@ function parseSkillFrontmatter(content) {
                     }
                     else if (key === 'allowed-tools' || key === 'allowedtools') {
                         // Parse as comma-separated or YAML array
-                        result.allowedTools = value.replace(/^\[|\]$/g, '').split(',').map(t => t.trim()).filter(Boolean);
+                        result.allowedTools = value
+                            .replace(/^\[|\]$/g, '')
+                            .split(',')
+                            .map((tool) => tool.trim())
+                            .filter(Boolean);
                     }
                 }
             }
@@ -154,15 +167,44 @@ function getSkillsConfig(projectPath) {
  * @param {string} projectPath
  * @returns {Object}
  */
-function getSkillDetail(skillName, location, projectPath) {
+async function getSkillDetail(skillName, location, projectPath, initialPath) {
     try {
-        const baseDir = location === 'project'
-            ? join(projectPath, '.claude', 'skills')
-            : join(homedir(), '.claude', 'skills');
+        if (skillName.includes('/') || skillName.includes('\\')) {
+            return { error: 'Access denied', status: 403 };
+        }
+        if (skillName.includes('..')) {
+            return { error: 'Invalid skill name', status: 400 };
+        }
+        let baseDir;
+        if (location === 'project') {
+            try {
+                const validatedProjectPath = await validateAllowedPath(projectPath, { mustExist: true, allowedDirectories: [initialPath] });
+                baseDir = join(validatedProjectPath, '.claude', 'skills');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const status = message.includes('Access denied') ? 403 : 400;
+                console.error(`[Skills] Project path validation failed: ${message}`);
+                return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+            }
+        }
+        else {
+            baseDir = join(homedir(), '.claude', 'skills');
+        }
         const skillDir = join(baseDir, skillName);
-        const skillMdPath = join(skillDir, 'SKILL.md');
-        if (!existsSync(skillMdPath)) {
-            return { error: 'Skill not found' };
+        const skillMdCandidate = join(skillDir, 'SKILL.md');
+        let skillMdPath;
+        try {
+            skillMdPath = await validateAllowedPath(skillMdCandidate, { mustExist: true, allowedDirectories: [skillDir] });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (message.includes('File not found')) {
+                return { error: 'Skill not found', status: 404 };
+            }
+            const status = message.includes('Access denied') ? 403 : 400;
+            console.error(`[Skills] Path validation failed: ${message}`);
+            return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
         }
         const content = readFileSync(skillMdPath, 'utf8');
         const parsed = parseSkillFrontmatter(content);
@@ -182,7 +224,7 @@ function getSkillDetail(skillName, location, projectPath) {
         };
     }
     catch (error) {
-        return { error: error.message };
+        return { error: error.message, status: 500 };
     }
 }
 /**
@@ -192,35 +234,49 @@ function getSkillDetail(skillName, location, projectPath) {
  * @param {string} projectPath
  * @returns {Object}
  */
-function deleteSkill(skillName, location, projectPath) {
+async function deleteSkill(skillName, location, projectPath, initialPath) {
     try {
-        const baseDir = location === 'project'
-            ? join(projectPath, '.claude', 'skills')
-            : join(homedir(), '.claude', 'skills');
-        const skillDir = join(baseDir, skillName);
-        if (!existsSync(skillDir)) {
-            return { error: 'Skill not found' };
-        }
-        // Recursively delete directory
-        const deleteRecursive = (dirPath) => {
-            if (existsSync(dirPath)) {
-                readdirSync(dirPath).forEach((file) => {
-                    const curPath = join(dirPath, file);
-                    if (statSync(curPath).isDirectory()) {
-                        deleteRecursive(curPath);
-                    }
-                    else {
-                        unlinkSync(curPath);
-                    }
-                });
-                fsPromises.rmdir(dirPath);
+        if (skillName.includes('/') || skillName.includes('\\')) {
+            return { error: 'Access denied', status: 403 };
+        }
+        if (skillName.includes('..')) {
+            return { error: 'Invalid skill name', status: 400 };
+        }
+        let baseDir;
+        if (location === 'project') {
+            try {
+                const validatedProjectPath = await validateAllowedPath(projectPath, { mustExist: true, allowedDirectories: [initialPath] });
+                baseDir = join(validatedProjectPath, '.claude', 'skills');
             }
-        };
-        deleteRecursive(skillDir);
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const status = message.includes('Access denied') ? 403 : 400;
+                console.error(`[Skills] Project path validation failed: ${message}`);
+                return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+            }
+        }
+        else {
+            baseDir = join(homedir(), '.claude', 'skills');
+        }
+        const skillDirCandidate = join(baseDir, skillName);
+        let skillDir;
+        try {
+            skillDir = await validateAllowedPath(skillDirCandidate, { mustExist: true, allowedDirectories: [baseDir] });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (message.includes('File not found')) {
+                return { error: 'Skill not found', status: 404 };
+            }
+            const status = message.includes('Access denied') ? 403 : 400;
+            console.error(`[Skills] Path validation failed: ${message}`);
+            return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+        }
+        await fsPromises.rm(skillDir, { recursive: true, force: true });
         return { success: true, skillName, location };
     }
     catch (error) {
-        return { error: error.message };
+        return { error: error.message, status: 500 };
     }
 }
 /**
@@ -327,6 +383,9 @@ async function importSkill(sourcePath, location, projectPath, customName) {
         }
         // Determine target folder name
         const skillName = customName || validation.skillInfo.name;
+        if (skillName.includes('/') || skillName.includes('\\') || skillName.includes('..')) {
+            return { error: 'Invalid skill name', status: 400 };
+        }
         const targetPath = join(baseDir, skillName);
         // Check if already exists
         if (existsSync(targetPath)) {
@@ -353,9 +412,12 @@ async function importSkill(sourcePath, location, projectPath, customName) {
  * @param {string} params.skillName - Name for the skill
  * @param {string} params.location - 'project' or 'user'
  * @param {string} params.projectPath - Project root path
+ * @param {Function} params.broadcastToClients - WebSocket broadcast function
  * @returns {Object}
  */
-async function generateSkillViaCLI({ generationType, description, skillName, location, projectPath }) {
+async function generateSkillViaCLI({ generationType, description, skillName, location, projectPath, broadcastToClients }) {
+    // Generate unique execution ID for tracking
+    const executionId = `skill-gen-${skillName}-${Date.now()}`;
     try {
         // Validate inputs
         if (!skillName) {
@@ -377,47 +439,100 @@ async function generateSkillViaCLI({ generationType, description, skillName, loc
         if (!existsSync(baseDir)) {
             await fsPromises.mkdir(baseDir, { recursive: true });
         }
-        // Build CLI prompt
+        // Build structured skill parameters for /skill-generator
         const targetLocationDisplay = location === 'project'
             ? '.claude/skills/'
             : '~/.claude/skills/';
-        const prompt = `PURPOSE: Generate a complete Claude Code skill from description
-TASK: • Parse skill requirements • Create SKILL.md with proper frontmatter (name, description, version, allowed-tools) • Generate supporting files if needed in skill folder
-MODE: write
-CONTEXT: @**/*
-EXPECTED: Complete skill folder structure with SKILL.md and all necessary files
-RULES: $(cat ~/.claude/workflows/cli-templates/prompts/universal/00-universal-rigorous-style.txt) | Follow Claude Code skill format | Include name, description in frontmatter | write=CREATE
+        // Structured fields from user input
+        const skillParams = {
+            skill_name: skillName,
+            description: description || 'Generate a basic skill template',
+            target_location: targetLocationDisplay,
+            target_path: targetPath,
+            location_type: location // 'project' | 'user'
+        };
+        // Prompt that invokes /skill-generator skill with structured parameters
+        const prompt = `/skill-generator
+
+## Skill Parameters (Structured Input)
 
-SKILL DESCRIPTION:
-${description || 'Generate a basic skill template'}
+\`\`\`json
+${JSON.stringify(skillParams, null, 2)}
+\`\`\`
 
-SKILL NAME: ${skillName}
-TARGET LOCATION: ${targetLocationDisplay}
-TARGET PATH: ${targetPath}
+## User Request
 
-REQUIREMENTS:
-1. Create SKILL.md with frontmatter containing:
-   - name: "${skillName}"
-   - description: Brief description of the skill
-   - version: "1.0.0"
-   - allowed-tools: List of tools this skill can use (e.g., [Read, Write, Edit, Bash])
-2. Add skill content below frontmatter explaining what the skill does and how to use it
-3. If the skill requires supporting files (e.g., templates, scripts), create them in the skill folder
-4. Ensure all files are properly formatted and follow best practices`;
+Create a new Claude Code skill with the following specifications:
+
+- **Skill Name**: ${skillName}
+- **Description**: ${description || 'Generate a basic skill template'}
+- **Target Location**: ${targetLocationDisplay}${skillName}
+- **Location Type**: ${location === 'project' ? 'Project-level (.claude/skills/)' : 'User-level (~/.claude/skills/)'}
+
+## Instructions
+
+1. Use the skill-generator to create a complete skill structure
+2. Generate SKILL.md with proper frontmatter (name, description, version, allowed-tools)
+3. Create necessary supporting files (phases, specs, templates as needed)
+4. Follow Claude Code skill design patterns and best practices
+5. Output all files to: ${targetPath}`;
+        // Broadcast CLI_EXECUTION_STARTED event
+        if (broadcastToClients) {
+            broadcastToClients({
+                type: 'CLI_EXECUTION_STARTED',
+                payload: {
+                    executionId,
+                    tool: 'claude',
+                    mode: 'write',
+                    category: 'internal',
+                    context: 'skill-generation',
+                    skillName
+                }
+            });
+        }
+        // Create onOutput callback for real-time streaming
+        const onOutput = broadcastToClients
+            ? (unit) => {
+                // CliOutputUnit handler: use SmartContentFormatter for intelligent formatting (never returns null)
+                const content = SmartContentFormatter.format(unit.content, unit.type);
+                broadcastToClients({
+                    type: 'CLI_OUTPUT',
+                    payload: {
+                        executionId,
+                        chunkType: unit.type,
+                        data: content
+                    }
+                });
+            }
+            : undefined;
         // Execute CLI tool (Claude) with write mode
+        const startTime = Date.now();
         const result = await executeCliTool({
             tool: 'claude',
             prompt,
             mode: 'write',
             cd: baseDir,
             timeout: 600000, // 10 minutes
-            category: 'internal'
-        });
+            category: 'internal',
+            id: executionId
+        }, onOutput);
+        // Broadcast CLI_EXECUTION_COMPLETED event
+        if (broadcastToClients) {
+            broadcastToClients({
+                type: 'CLI_EXECUTION_COMPLETED',
+                payload: {
+                    executionId,
+                    success: result.success,
+                    status: result.execution?.status || (result.success ? 'success' : 'error'),
+                    duration_ms: Date.now() - startTime
+                }
+            });
+        }
         // Check if execution was successful
         if (!result.success) {
             return {
                 error: `CLI generation failed: ${result.stderr || 'Unknown error'}`,
-                stdout: result.stdout,
+                stdout: result.parsedOutput || result.stdout,
                 stderr: result.stderr
             };
         }
@@ -426,7 +541,7 @@ REQUIREMENTS:
         if (!validation.valid) {
             return {
                 error: `Generated skill is invalid: ${validation.errors.join(', ')}`,
-                stdout: result.stdout,
+                stdout: result.parsedOutput || result.stdout,
                 stderr: result.stderr
             };
         }
@@ -435,7 +550,7 @@ REQUIREMENTS:
             skillName: validation.skillInfo.name,
             location,
             path: targetPath,
-            stdout: result.stdout,
+            stdout: result.parsedOutput || result.stdout,
             stderr: result.stderr
         };
     }
@@ -449,13 +564,23 @@ REQUIREMENTS:
  * @returns true if route was handled, false otherwise
  */
 export async function handleSkillsRoutes(ctx) {
-    const { pathname, url, req, res, initialPath, handlePostRequest } = ctx;
+    const { pathname, url, req, res, initialPath, handlePostRequest, broadcastToClients } = ctx;
     // API: Get all skills (project and user)
     if (pathname === '/api/skills') {
         const projectPathParam = url.searchParams.get('path') || initialPath;
-        const skillsData = getSkillsConfig(projectPathParam);
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify(skillsData));
+        try {
+            const validatedProjectPath = await validateAllowedPath(projectPathParam, { mustExist: true, allowedDirectories: [initialPath] });
+            const skillsData = getSkillsConfig(validatedProjectPath);
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(skillsData));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const status = message.includes('Access denied') ? 403 : 400;
+            console.error(`[Skills] Project path validation failed: ${message}`);
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path', projectSkills: [], userSkills: [] }));
+        }
         return true;
     }
     // API: List skill directory contents
@@ -465,16 +590,46 @@ export async function handleSkillsRoutes(ctx) {
         const subPath = url.searchParams.get('subpath') || '';
         const location = url.searchParams.get('location') || 'project';
         const projectPathParam = url.searchParams.get('path') || initialPath;
-        const baseDir = location === 'project'
-            ? join(projectPathParam, '.claude', 'skills')
-            : join(homedir(), '.claude', 'skills');
-        const dirPath = subPath
-            ? join(baseDir, skillName, subPath)
-            : join(baseDir, skillName);
-        // Security check: ensure path is within skill folder
-        if (!dirPath.startsWith(join(baseDir, skillName))) {
-            res.writeHead(403, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Access denied' }));
+        if (skillName.includes('/') || skillName.includes('\\') || skillName.includes('..')) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid skill name' }));
+            return true;
+        }
+        let baseDir;
+        if (location === 'project') {
+            try {
+                const validatedProjectPath = await validateAllowedPath(projectPathParam, { mustExist: true, allowedDirectories: [initialPath] });
+                baseDir = join(validatedProjectPath, '.claude', 'skills');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const status = message.includes('Access denied') ? 403 : 400;
+                console.error(`[Skills] Project path validation failed: ${message}`);
+                res.writeHead(status, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path' }));
+                return true;
+            }
+        }
+        else {
+            baseDir = join(homedir(), '.claude', 'skills');
+        }
+        const skillRoot = join(baseDir, skillName);
+        const requestedDir = subPath ? join(skillRoot, subPath) : skillRoot;
+        let dirPath;
+        try {
+            dirPath = await validateAllowedPath(requestedDir, { mustExist: true, allowedDirectories: [skillRoot] });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (message.includes('File not found')) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Directory not found' }));
+                return true;
+            }
+            const status = message.includes('Access denied') ? 403 : 400;
+            console.error(`[Skills] Path validation failed: ${message}`);
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path' }));
             return true;
         }
         if (!existsSync(dirPath)) {
@@ -516,14 +671,46 @@ export async function handleSkillsRoutes(ctx) {
             res.end(JSON.stringify({ error: 'filename parameter is required' }));
             return true;
         }
-        const baseDir = location === 'project'
-            ? join(projectPathParam, '.claude', 'skills')
-            : join(homedir(), '.claude', 'skills');
-        const filePath = join(baseDir, skillName, fileName);
-        // Security check: ensure file is within skill folder
-        if (!filePath.startsWith(join(baseDir, skillName))) {
-            res.writeHead(403, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Access denied' }));
+        if (skillName.includes('/') || skillName.includes('\\') || skillName.includes('..')) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid skill name' }));
+            return true;
+        }
+        let baseDir;
+        if (location === 'project') {
+            try {
+                const validatedProjectPath = await validateAllowedPath(projectPathParam, { mustExist: true, allowedDirectories: [initialPath] });
+                baseDir = join(validatedProjectPath, '.claude', 'skills');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const status = message.includes('Access denied') ? 403 : 400;
+                console.error(`[Skills] Project path validation failed: ${message}`);
+                res.writeHead(status, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path' }));
+                return true;
+            }
+        }
+        else {
+            baseDir = join(homedir(), '.claude', 'skills');
+        }
+        const skillRoot = join(baseDir, skillName);
+        const requestedFile = join(skillRoot, fileName);
+        let filePath;
+        try {
+            filePath = await validateAllowedPath(requestedFile, { mustExist: true, allowedDirectories: [skillRoot] });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (message.includes('File not found')) {
+                res.writeHead(404, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'File not found' }));
+                return true;
+            }
+            const status = message.includes('Access denied') ? 403 : 400;
+            console.error(`[Skills] Path validation failed: ${message}`);
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: status === 403 ? 'Access denied' : 'Invalid path' }));
             return true;
         }
         if (!existsSync(filePath)) {
@@ -547,20 +734,50 @@ export async function handleSkillsRoutes(ctx) {
         const pathParts = pathname.split('/');
         const skillName = decodeURIComponent(pathParts[3]);
         handlePostRequest(req, res, async (body) => {
-            const { fileName, content, location, projectPath: projectPathParam } = body;
-            if (!fileName) {
+            if (!isRecord(body)) {
+                return { error: 'Invalid request body', status: 400 };
+            }
+            const fileName = body.fileName;
+            const content = body.content;
+            const location = body.location === 'project' ? 'project' : 'user';
+            const projectPathParam = typeof body.projectPath === 'string' ? body.projectPath : undefined;
+            if (typeof fileName !== 'string' || !fileName) {
                 return { error: 'fileName is required' };
             }
-            if (content === undefined) {
+            if (typeof content !== 'string') {
                 return { error: 'content is required' };
             }
-            const baseDir = location === 'project'
-                ? join(projectPathParam || initialPath, '.claude', 'skills')
-                : join(homedir(), '.claude', 'skills');
-            const filePath = join(baseDir, skillName, fileName);
-            // Security check: ensure file is within skill folder
-            if (!filePath.startsWith(join(baseDir, skillName))) {
-                return { error: 'Access denied' };
+            if (skillName.includes('/') || skillName.includes('\\') || skillName.includes('..')) {
+                return { error: 'Invalid skill name', status: 400 };
+            }
+            let baseDir;
+            if (location === 'project') {
+                try {
+                    const projectRoot = projectPathParam || initialPath;
+                    const validatedProjectPath = await validateAllowedPath(projectRoot, { mustExist: true, allowedDirectories: [initialPath] });
+                    baseDir = join(validatedProjectPath, '.claude', 'skills');
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    const status = message.includes('Access denied') ? 403 : 400;
+                    console.error(`[Skills] Project path validation failed: ${message}`);
+                    return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+                }
+            }
+            else {
+                baseDir = join(homedir(), '.claude', 'skills');
+            }
+            const skillRoot = join(baseDir, skillName);
+            const requestedFile = join(skillRoot, fileName);
+            let filePath;
+            try {
+                filePath = await validateAllowedPath(requestedFile, { allowedDirectories: [skillRoot] });
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const status = message.includes('Access denied') ? 403 : 400;
+                console.error(`[Skills] Path validation failed: ${message}`);
+                return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
             }
             try {
                 await fsPromises.writeFile(filePath, content, 'utf8');
@@ -576,68 +793,133 @@ export async function handleSkillsRoutes(ctx) {
     if (pathname.startsWith('/api/skills/') && req.method === 'GET' &&
         !pathname.endsWith('/skills/') && !pathname.endsWith('/dir') && !pathname.endsWith('/file')) {
         const skillName = decodeURIComponent(pathname.replace('/api/skills/', ''));
-        const location = url.searchParams.get('location') || 'project';
+        const locationParam = url.searchParams.get('location');
+        const location = locationParam === 'user' ? 'user' : 'project';
         const projectPathParam = url.searchParams.get('path') || initialPath;
-        const skillDetail = getSkillDetail(skillName, location, projectPathParam);
+        const skillDetail = await getSkillDetail(skillName, location, projectPathParam, initialPath);
         if (skillDetail.error) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify(skillDetail));
-        }
-        else {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify(skillDetail));
+            res.writeHead(skillDetail.status || 404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: skillDetail.error }));
+            return true;
         }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(skillDetail));
         return true;
     }
     // API: Delete skill
     if (pathname.startsWith('/api/skills/') && req.method === 'DELETE') {
         const skillName = decodeURIComponent(pathname.replace('/api/skills/', ''));
+        if (skillName.includes('/') || skillName.includes('\\')) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Access denied' }));
+            return true;
+        }
+        if (skillName.includes('..')) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid skill name' }));
+            return true;
+        }
         handlePostRequest(req, res, async (body) => {
-            const { location, projectPath: projectPathParam } = body;
-            return deleteSkill(skillName, location, projectPathParam || initialPath);
+            if (!isRecord(body)) {
+                return { error: 'Invalid request body', status: 400 };
+            }
+            const location = body.location === 'project' ? 'project' : 'user';
+            const projectPathParam = typeof body.projectPath === 'string' ? body.projectPath : undefined;
+            return deleteSkill(skillName, location, projectPathParam || initialPath, initialPath);
         });
         return true;
     }
     // API: Validate skill import
     if (pathname === '/api/skills/validate-import' && req.method === 'POST') {
         handlePostRequest(req, res, async (body) => {
-            const { sourcePath } = body;
-            if (!sourcePath) {
+            if (!isRecord(body)) {
+                return { valid: false, errors: ['Source path is required'], skillInfo: null };
+            }
+            const sourcePath = body.sourcePath;
+            if (typeof sourcePath !== 'string' || !sourcePath.trim()) {
                 return { valid: false, errors: ['Source path is required'], skillInfo: null };
             }
-            return validateSkillFolder(sourcePath);
+            try {
+                const validatedSourcePath = await validateAllowedPath(sourcePath, { mustExist: true });
+                return validateSkillFolder(validatedSourcePath);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                const status = message.includes('Access denied') ? 403 : 400;
+                console.error(`[Skills] Path validation failed: ${message}`);
+                return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+            }
         });
         return true;
     }
     // API: Create/Import skill
     if (pathname === '/api/skills/create' && req.method === 'POST') {
         handlePostRequest(req, res, async (body) => {
-            const { mode, location, sourcePath, skillName, description, generationType, projectPath: projectPathParam } = body;
-            if (!mode) {
+            if (!isRecord(body)) {
+                return { error: 'Invalid request body', status: 400 };
+            }
+            const mode = body.mode;
+            const locationValue = body.location;
+            const sourcePath = typeof body.sourcePath === 'string' ? body.sourcePath : undefined;
+            const skillName = typeof body.skillName === 'string' ? body.skillName : undefined;
+            const description = typeof body.description === 'string' ? body.description : undefined;
+            const generationType = typeof body.generationType === 'string' ? body.generationType : undefined;
+            const projectPathParam = typeof body.projectPath === 'string' ? body.projectPath : undefined;
+            if (typeof mode !== 'string' || !mode) {
                 return { error: 'Mode is required (import or cli-generate)' };
             }
-            if (!location) {
+            if (locationValue !== 'project' && locationValue !== 'user') {
                 return { error: 'Location is required (project or user)' };
             }
+            const location = locationValue;
             const projectPath = projectPathParam || initialPath;
+            let validatedProjectPath = projectPath;
+            if (location === 'project') {
+                try {
+                    validatedProjectPath = await validateAllowedPath(projectPath, { mustExist: true, allowedDirectories: [initialPath] });
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    const status = message.includes('Access denied') ? 403 : 400;
+                    console.error(`[Skills] Project path validation failed: ${message}`);
+                    return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+                }
+            }
             if (mode === 'import') {
                 // Import mode: copy existing skill folder
                 if (!sourcePath) {
                     return { error: 'Source path is required for import mode' };
                 }
-                return await importSkill(sourcePath, location, projectPath, skillName);
+                if (skillName && (skillName.includes('/') || skillName.includes('\\') || skillName.includes('..'))) {
+                    return { error: 'Invalid skill name', status: 400 };
+                }
+                let validatedSourcePath;
+                try {
+                    validatedSourcePath = await validateAllowedPath(sourcePath, { mustExist: true });
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    const status = message.includes('Access denied') ? 403 : 400;
+                    console.error(`[Skills] Path validation failed: ${message}`);
+                    return { error: status === 403 ? 'Access denied' : 'Invalid path', status };
+                }
+                return await importSkill(validatedSourcePath, location, validatedProjectPath, skillName);
             }
             else if (mode === 'cli-generate') {
                 // CLI generate mode: use Claude to generate skill
                 if (!skillName) {
                     return { error: 'Skill name is required for CLI generation mode' };
                 }
+                if (skillName.includes('/') || skillName.includes('\\') || skillName.includes('..')) {
+                    return { error: 'Invalid skill name', status: 400 };
+                }
                 return await generateSkillViaCLI({
-                    generationType: generationType || 'description',
+                    generationType: generationType === 'template' ? 'template' : 'description',
                     description,
                     skillName,
                     location,
-                    projectPath
+                    projectPath: validatedProjectPath,
+                    broadcastToClients
                 });
             }
             else {