fix(skills): a punctuated skill name must not cost the whole skill

[rubenvdlinde]

Found while publishing spectr's toolkit: intelligence:update was dropped from the bundle with invalid_name.

Why that was wrong

The colon is the /namespace:command convention, and it only ever mattered to a directory name. The skill keeps whatever its frontmatter says, and fromBundle() records the folder separately as bundleName — the two are already distinct concepts. Losing a skill over its folder name is a far worse outcome than renaming the folder.

Names are now folded to a safe directory (intelligence:update → intelligence-update) instead of rejected.

The security guarantee is kept, and sharpened

The original "reject totally, never sanitise" existed so .., / and \ could never reach a path concatenation. That still holds, and the distinction is now explicit:

A path is never a name. Anything carrying a separator or traversal sequence is still rejected outright — laundering ../../etc/passwd into a tidy etc folder would accept a hostile value under a clean-looking name, which is worse than refusing it. Only genuinely punctuated names reach the sanitiser, which is an allowlist ([^a-z0-9]+ → -) and still validates against NAME_PATTERN before returning, so a non-conforming value cannot escape the method.

A collision the old code could not have

Sanitising means two names can fold onto one directory. Writing both would silently overwrite the first — a dropped skill wearing a successful publish, the exact defect this programme keeps turning up. Reported as duplicate_directory_name instead.

Mutation check — and my first attempt was vacuous

Disabling only the / check left the .. check still catching the input, so the suite stayed green and proved nothing. Disabling the whole guard turns 2 tests red; restoring returns to green.

1424 tests OK · phpcs 0 · phpstan 0 · phpmd 0.

[github-actions]

Quality Report — ConductionNL/hermiq @ 1ee8afe

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 117/117
npm			✅	✅ 657/657
PHPUnit					✅
Newman					✅
Playwright					⏭️

Coverage: 85.3% (93/109 statements)

---

Quality workflow — 2026-08-02 11:44 UTC

Download the full PDF report from the workflow artifacts.