{"id":"GHSA-6xx4-9wp6-65p7","aliases":[],"status":"published","title":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","description":"### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -\u003e /home/\u003cuser\u003e/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link's **target**. A malicious skill source — for example a git\nrepository installed via `skilo add github.com/\u003cattacker\u003e/\u003cskills\u003e`, or a local\npath — could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59","CWE-61"],"published":"2026-07-28T22:23:48Z","modified":"2026-07-28T22:30:30Z","fixes":[{"ecosystem":"crates.io","package":"skilo","fixed_in":["0.11.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"skilo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.0"},{"fixed":"0.11.1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"skilo","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.0"},{"fixed":"0.11.1"}]}]}],"references":[{"url":"https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7","tags":["web"]},{"url":"https://github.com/manuelmauro/skilo/pull/11","tags":["web"]},{"url":"https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e","tags":["web"]},{"url":"https://github.com/manuelmauro/skilo/releases/tag/v0.11.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6xx4-9wp6-65p7"},{"url":"https://github.com/manuelmauro/skilo","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-6xx4-9wp6-65p7","title":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","description":"### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -\u003e /home/\u003cuser\u003e/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link's **target**. A malicious skill source — for example a git\nrepository installed via `skilo add github.com/\u003cattacker\u003e/\u003cskills\u003e`, or a local\npath — could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.","status":"published","published":"2026-07-28T22:23:48Z","modified":"2026-07-28T22:23:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-59","CWE-61"],"updated_at":"2026-11-02T14:40:53.707378Z"}],"osv":[{"id":"GHSA-6xx4-9wp6-65p7","title":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","description":"### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -\u003e /home/\u003cuser\u003e/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link's **target**. A malicious skill source — for example a git\nrepository installed via `skilo add github.com/\u003cattacker\u003e/\u003cskills\u003e`, or a local\npath — could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.","status":"published","published":"2026-07-28T22:23:48Z","modified":"2026-07-28T22:30:30.937595729Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-59","CWE-61"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}