[singhharsh1708]

Re-targets #97 at main. #97 was opened against feat/update-diff (it was stacked on #96) and merged there, but #96 was squash-merged into main separately — so these fixes never reached main. This is the same commit, cherry-picked cleanly onto main, with the full gate re-run: typecheck clean, suite green, benchmark deterministic, site/build.mjs --check current, schema parses.

Everything below was reachable in published 0.13.0.

Install-gate bypasses

	Bypass	Fix
1	A trailing {{ broken }} made resolveBody() throw, and the four "non-bypassable" safety lints only ran when it succeeded — so curl … | sh plus a broken token installed with exit 0	scanners run on the raw source when resolution fails; only budget measurement stays gated
2	One NUL byte marked any auxiliary file "binary" and skipped every scanner on it, while the file stayed readable prose	binary = control-char density over 8 KB; NULs stripped before scanning and reported as hidden text
3	[__proto__.policy] in an untrusted skill.toml wrote onto Object.prototype, handing itself deny_remote_exec = false before loadPolicy() ran	null-prototype tables; __proto__/constructor/prototype refused as table or key names
4	allow_sources matched the un-normalized string, so file:/approved/../untrusted/evil passed an /approved/* allowlist — and was persisted as the lockfile source, so doctor reported policy: ok forever	canonical-only matching; the error shows both forms when they differ

Plus a path traversal: triggers.commands was only checked for a leading /, and the claude-code adapter builds .claude/commands/<cmd>.md from it verbatim, so "/../../../../../../tmp/x" made compile write six levels above the project. The schema always specified ^/[a-z][a-z0-9-]*$; it is now enforced at manifest load, and compile refuses any output path resolving outside the project root.

Output-integrity bugs

• mergeSection passed the compiled body as a String.replace replacement, so a skill documenting $$ (Make), $& (sed) or $' corrupted AGENTS.md on the second compile — $$HOME silently became $HOME, and $& spliced the old section into itself leaving doubled markers that broke pruning.
• compile silently dropped skills whose manifest stopped loading and pruned their AGENTS.md sections, exiting 0 — the skill still on disk, still pinned, every agent quietly losing its instructions.
• Installing owner/repo copied the clone's .git; git's index/reflog differ between two clones of the same commit, so update/diff never converged and the review diff filled with .git/….
• An unmanifested skill installed from a repo root was named after the random mkdtemp directory, so every update derived a new name and refused itself as a rename, forever.
• update/diff showed added files in full but listed removed ones by name only — deleting the script a SKILL.md points at passed review unseen.
• site/build.mjs had the same $-as-replacement-pattern bug, found because the 0.15.0 changelog entry documents $$ and $&: the generated HTML duplicated outside its markers and never converged, so --check reported the page permanently stale.

Verification

Findings came from a multi-agent audit — five independent review passes, every finding reproduced before it was accepted — and each fix carries a regression test that reproduces the original exploit (A1–A10, 24 assertions). The three highest-severity exploits were also re-run by hand against the built CLI: all now exit 1 with a named lint or manifest error, and the traversal file is never created.

One pre-existing fixture relied on the lax command validation; the case it covered is now asserted at manifest-load time instead, alongside a traversal case.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kitbash	Ready	Preview	Aug 7, 2026 7:41am