{"id":"GHSA-6xx4-9wp6-65p7","title":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","summary":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","severity":"medium","cvss":6.5,"cwe":["CWE-59","CWE-61"],"vendor":"skilo","product":"skilo","ecosystem":"rust","affected":["skilo >= 0.5.0, < 0.11.1"],"patched":["skilo 0.11.1"],"published":"2026-07-28","updated":"2026-07-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6xx4-9wp6-65p7","references":[{"url":"https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7"},{"url":"https://github.com/manuelmauro/skilo/pull/11"},{"url":"https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e"},{"url":"https://github.com/manuelmauro/skilo/releases/tag/v0.11.1"},{"url":"https://github.com/advisories/GHSA-6xx4-9wp6-65p7"}],"tags":["ghsa","rust"],"ingestedAt":"2026-07-28T22:40:03.116Z","slug":"GHSA-6xx4-9wp6-65p7","body":"## Overview\n\n### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -> /home/<user>/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link's **target**. A malicious skill source — for example a git\nrepository installed via `skilo add github.com/<attacker>/<skills>`, or a local\npath — could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.\n\n## Affected packages\n\n- `skilo >= 0.5.0, < 0.11.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `skilo 0.11.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}