 YeonGyu-Kim
|
98659783c0
|
fix(security): confine file resolution to project roots
Block traversal, out-of-root absolute path, and symlink escapes for @file references, file:// URIs, and config skill file loading while logging rejected attempts.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
|
2026-04-02 14:55:35 +09:00 |
|
|
YeonGyu-Kim
|
51ced65b5f
|
refactor(opencode-skill-loader): split loader and merger into focused modules
Extract skill loading pipeline into single-responsibility modules:
- skill-discovery.ts, skill-directory-loader.ts, skill-deduplication.ts
- loaded-skill-from-path.ts, loaded-skill-template-extractor.ts
- skill-template-resolver.ts, skill-definition-record.ts
- git-master-template-injection.ts, allowed-tools-parser.ts
- skill-mcp-config.ts, skill-resolution-options.ts
- merger/ directory for skill merging logic
|
2026-02-08 16:21:19 +09:00 |
|