{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "skilo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "0.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-59",
      "CWE-61"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T22:23:48Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` \u2014 which does **not** follow symlinks \u2014 and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -\u003e /home/\u003cuser\u003e/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link\u0027s **target**. A malicious skill source \u2014 for example a git\nrepository installed via `skilo add github.com/\u003cattacker\u003e/\u003cskills\u003e`, or a local\npath \u2014 could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.",
  "id": "GHSA-6xx4-9wp6-65p7",
  "modified": "2026-07-28T22:23:48Z",
  "published": "2026-07-28T22:23:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/manuelmauro/skilo/pull/11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/manuelmauro/skilo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/manuelmauro/skilo/releases/tag/v0.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source"
}