Skip to content
OpenAdvisories

Package · crates.io

skilo

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    GHSA-6xx4-9wp6-65p7

    skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

    ### Impact `skilo add` installs a skill by recursively copying the skill directory into the target skills directory. The copy routine (`copy_dir_all`) classified each entry with `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and then …

    skilo crates.io