chore: debug log for untrusted absolute skill paths; drop misleading test patch
Review findings: (a) an absolute path outside trusted roots passes through unchanged and gets rejected downstream by skill_view — add a debug log at the pass-through so the cron 'skill not found' symptom is diagnosable next time; (b) test_relative_path_unchanged patched get_skills_dir although the relative branch early-returns before any root lookup — drop the misleading patch.
This commit is contained in:
@@ -556,6 +556,11 @@ def normalize_skill_lookup_name(identifier: str) -> str:
|
||||
try:
|
||||
return str(identifier_path.resolve().relative_to(primary_root.resolve()))
|
||||
except Exception:
|
||||
logger.debug(
|
||||
"Skill identifier %r is an absolute path outside trusted skills "
|
||||
"roots — passing through unchanged (skill_view will reject it)",
|
||||
raw_identifier,
|
||||
)
|
||||
return raw_identifier
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user