---
id: GHSA-6xx4-9wp6-65p7
title: >-
  skilo add follows symbolic links, allowing arbitrary local file disclosure
  from a malicious skill source
summary: >-
  skilo add follows symbolic links, allowing arbitrary local file disclosure
  from a malicious skill source
severity: medium
cvss: 6.5
cwe:
  - CWE-59
  - CWE-61
vendor: skilo
product: skilo
ecosystem: rust
affected:
  - 'skilo >= 0.5.0, < 0.11.1'
patched:
  - skilo 0.11.1
published: '2026-07-28'
updated: '2026-07-28'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6xx4-9wp6-65p7'
references:
  - url: >-
      https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7
  - url: 'https://github.com/manuelmauro/skilo/pull/11'
  - url: >-
      https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e
  - url: 'https://github.com/manuelmauro/skilo/releases/tag/v0.11.1'
  - url: 'https://github.com/advisories/GHSA-6xx4-9wp6-65p7'
tags:
  - ghsa
  - rust
ingestedAt: '2026-07-28T22:40:03.116Z'
---

## Overview

### Impact

`skilo add` installs a skill by recursively copying the skill directory into the
target skills directory. The copy routine (`copy_dir_all`) classified each entry
with `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and
then copied non-directory entries with `std::fs::copy()`, which **does**
dereference symlinks.

As a result, a skill containing a symbolic link such as
`reference.txt -> /home/<user>/.ssh/id_rsa` was copied as a regular file whose
contents are the link's **target**. A malicious skill source — for example a git
repository installed via `skilo add github.com/<attacker>/<skills>`, or a local
path — could read arbitrary files readable by the user running `skilo add` (SSH
keys, cloud credentials, `.env` files, etc.) and place their contents inside the
installed skill directory, where the user or their agent may later read, share,
or sync them.

This is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)
triggered by installing an untrusted skills source.

### Patches

Fixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any
recursion depth (failing closed with a dedicated error) instead of dereferencing
them.

### Workarounds

- Only install skills from sources you trust.
- Inspect a skill source for symbolic links before running `skilo add`.

### Affected versions

Introduced together with the `skilo add` command in 0.5.0 and present through
0.11.0. Releases before 0.5.0 do not include the `add` command.

## Affected packages

- `skilo >= 0.5.0, < 0.11.1`

## Remediation

Upgrade to a patched release:

- `skilo 0.11.1`