Sunil 4b3122e65f security: validate --behavioral skillName to prevent path traversal ...

The skillName argument from --behavioral has zero validation and is
used directly in path.join() for reading .json files, reading
SKILL.md, and WRITING .grading.json results. A value like
'../../etc/passwd' traverses outside the project directory for
both reads and writes.

Fix: Validate skillName against /^[a-z0-9]+(-[a-z0-9]+)*$/ before
any filesystem operations. This matches the existing KEBAB_CASE
validation in skill-lint.js.

2026-08-05 22:35:47 +05:30

..

lib

fix(validator): reject fenced-block headings and negated triggers (#387)

2026-07-16 10:47:14 -04:00

run-evals-test.js

feat: support trusted dialogue evals

2026-07-12 22:13:34 +08:00

run-evals.js

security: validate --behavioral skillName to prevent path traversal

2026-08-05 22:35:47 +05:30

validate-commands-test.js

test: cover command validator behavior

2026-08-01 10:41:53 +01:00

validate-commands.js

fix: harden eval and command validation

2026-07-09 18:03:46 +03:00

validate-skills.js

refactor(validate-skills): extract lint rules into scripts/lib/skill-lint.js

2026-07-10 00:49:00 +02:00