NVIDIA / holodeck / 25983871252

49%

main: 48%

Build Type

push

github

Committed by ArangoGutierrez

Commit Message

feat(skill): validate skill names with allowlist regex

parseSkill now rejects skill names that don't match
^[a-z0-9][a-z0-9-]{0,63}$. The catalog is //go:embed today so this
is defense-in-depth, but it hardens the parser against future
loaders that read SKILL.md from disk or network. Without this,
a SKILL.md with 'name: ../../etc/cron.d/evil' would let renderers
write outside the intended directory via filepath.Join.

Adds table-driven cases for path-traversal, leading-hyphen,
uppercase, underscore, and embedded-space rejections.

Closes #815.

Signed-off-by: Carlos Eduardo Arango Gutierrez <eduardoa@nvidia.com>

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

41 existing lines in 3 files now uncovered.

5606 of 11518 relevant lines covered (48.67%)

0.54 hits per line