{"id":"GHSA-6xx4-9wp6-65p7","aliases":[],"url":"https://o3.security/vulnerability/GHSA-6xx4-9wp6-65p7","summary":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","details":"### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -> /home/<user>/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link's **target**. A malicious skill source — for example a git\nrepository installed via `skilo add github.com/<attacker>/<skills>`, or a local\npath — could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.","published":"2026-07-28T22:23:48Z","modified":"2026-07-28T22:30:30.937595729Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"skilo","fixedVersion":"0.11.1"}],"fix":{"url":"https://github.com/manuelmauro/skilo/pull/11","label":"manuelmauro/skilo#11"},"references":[{"type":"WEB","url":"https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7"},{"type":"WEB","url":"https://github.com/manuelmauro/skilo/pull/11"},{"type":"WEB","url":"https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e"},{"type":"PACKAGE","url":"https://github.com/manuelmauro/skilo"},{"type":"WEB","url":"https://github.com/manuelmauro/skilo/releases/tag/v0.11.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-28T22:30:30.937595729Z"}}