Release Skills Manager v1.33.1 · xingkongliang/skills-manager

Skills Manager v1.33.1

发布日期：2026-08-12
递交范围：v1.33.0...v1.33.1

从 git URL 安装不会再读到仓库之外 —— …/tree/<分支>/<路径> 里的路径部分被直接拼到克隆目录上，没有校验是否还在目录内；路径往上跳得够多就会解析到你机器上的任意目录，然后被复制进技能库，并提示安装成功。由于技能库可以备份到 git 远端，这样拉进来的内容还可能被推出本机。skills.sh 简写里 @ 后面带路径的情况同理。现在两者都会被拒绝。桌面端和 CLI 同样受影响。
git URL 指向不存在的目录时会报错 —— 此前会回退成搜索整个仓库；对于把技能收在子目录里的仓库，结果是把整个 skills/ 容器当成一个条目装进来。安装 …/tree/main/artifacts-builder（真实路径其实是 skills/web-artifacts-builder）现在会直接说找不到，而不是悄悄装进 17 个不相关的技能。
技能在上游被挪走时，更新不会再换成别的目录 —— 如果某个 skills.sh 技能记录的路径被上游改成了容器或不相关的目录，更新会把那个目录覆盖到你已安装的技能上。现在只有记录的路径仍然是一个技能时才会采用，否则去新位置查找——和路径彻底消失时的行为一致。

resolve_skill_dir 用 path_guard::is_path_safe 同时校验请求的 subpath 和 find_skill_dir 最终解析出的目录，把 locator 那条路也覆盖上：parse_skillssh_shorthand 并不限制 @ 之后只能是单个路径段，而 find_skill_dir 会在三处把该 id 拼到检出目录上。
新增 10 个回归测试：..、绝对路径、符号链接三类逃逸在有无 locator 两种情况下的拦截；无 locator 时路径缺失报错；上游移动后 locator 的恢复；locator 找不到时仍报错（保住 #278 的断言）；以及 preview/confirm 安装流程的容器枚举。

English release notes

Release date: 2026-08-12
Commit range: v1.33.0...v1.33.1

Security fix: a crafted git URL could make an install copy a directory from outside the cloned repository into your library. Update if you install skills from links other people share.

Installing from a git URL can no longer reach outside the repository — The path part of a …/tree/<branch>/<path> URL was joined onto the clone without checking that it stayed inside it, so a URL whose path climbed far enough resolved to an arbitrary directory on your machine, which was then copied into the library and reported as a successful install. Because the library can be backed up to a git remote, content pulled in this way could also leave the machine. The same applies to a skills.sh shorthand whose @ part contains a path. Both are now refused. This affected the desktop app and the CLI equally.
A git URL pointing at a directory that does not exist is now an error — It used to fall back to searching the whole repository, which for a repository that groups its skills installed the entire skills/ container as a single entry. Installing …/tree/main/artifacts-builder from a repo whose real path is skills/web-artifacts-builder now says so instead of quietly installing 17 unrelated skills as one.
Updates no longer substitute a different directory when a skill moves upstream — If a skills.sh skill's recorded path was taken over by a container or an unrelated directory, an update copied that over your installed skill. The recorded path is now used only when it still holds a skill; otherwise the skill is looked up at its new home, as it already was when the path disappeared entirely.

resolve_skill_dir validates both the requested subpath and the directory finally resolved by find_skill_dir with path_guard::is_path_safe, covering the locator route as well: parse_skillssh_shorthand does not constrain the part after @ to a single path segment, and find_skill_dir joins that id onto the checkout in three places.
10 regression tests: .., absolute-path and symlink escapes with and without a locator; a missing path with no locator; locator recovery after an upstream move; a locator finding nothing (preserving the #278 assertions); and container enumeration for the preview/confirm install flow.

✅ Cross-platform build passed (macOS Intel / macOS ARM / Windows x64 / Linux x64)
✅ TypeScript typecheck passed

Full changelog files: English | 中文