reject symlinked skill roots when bundling

Author: charlesvien

packages/workspace-server/src/services/skills/skill-bundler.ts

@@ -23,7 +23,19 @@ function getSafeSkillFileName(name: string): string {
 }
 
 async function assertSkillRoot(skillPath: string): Promise<string> {
-  const root = await fs.promises.realpath(path.resolve(skillPath));
+  const lexical = path.resolve(skillPath);
+  const parentReal = await fs.promises.realpath(path.dirname(lexical));
+  const root = await fs.promises.realpath(lexical);
+  // A symlinked skill root bundles whatever it points at, so a repository could
+  // commit `.claude/skills/foo -> ~/.claude/skills/foo` and exfiltrate a
+  // directory from outside the repo into an uploaded bundle. Only the skill
+  // directory itself must be real; symlinked ancestors (e.g. /tmp on macOS)
+  // stay legal.
+  if (root !== path.join(parentReal, path.basename(lexical))) {
+    throw new Error(
+      "Local skill bundle root must be a real directory, not a symlink",
+    );
+  }
   const skillMdPath = path.join(root, "SKILL.md");
   const stat = await fs.promises.stat(skillMdPath);
   if (!stat.isFile()) {

packages/workspace-server/src/services/skills/skills.test.ts

@@ -502,6 +502,24 @@ describe("write-path guard", () => {
     ).rejects.toThrow("not a known skill directory");
   });
 
+  it("rejects a symlinked skill root", async () => {
+    // A repository could commit `.claude/skills/foo` as a symlink to a
+    // directory outside the repo; bundling must refuse to follow it rather
+    // than upload the external target.
+    const target = await createSkill(root, "linked");
+    const linkPath = path.join(repoSkillsDir, "linked");
+    await symlink(target, linkPath, "dir");
+    const service = makeService();
+
+    await expect(
+      service.bundleLocalSkill({
+        name: "linked",
+        source: "repo",
+        path: linkPath,
+      }),
+    ).rejects.toThrow("not a symlink");
+  });
+
   it.each([
     ["bundled skill", () => path.join(pluginPath, "skills", "bundled-skill")],
     ["arbitrary directory", () => path.join(root, "rogue")],