{"answers":{"affected":"2 open source packages ship an affected version, including skilo.","exploited":"There is no known exploitation of GHSA-6xx4-9wp6-65p7 in the wild and no public exploit code.","fix":"Upgrade skilo to 0.11.1 or later.","what":"GHSA-6xx4-9wp6-65p7 is a path traversal vulnerability in skilo, published on 28 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-6xx4-9wp6-65p7 and fix it if it is affected.\n\nWhat it is: GHSA-6xx4-9wp6-65p7 is a path traversal vulnerability in skilo, published on 28 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-6xx4-9wp6-65p7 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- skilo (crates.io): affected from 0.5.0; fixed in 0.11.1\n- skilo (crates.io): affected from 0.5.0; fixed in 0.11.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/ (Markdown: https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/index.md)","id":"GHSA-6xx4-9wp6-65p7","markdown":"https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/index.md","name":"GHSA-6xx4-9wp6-65p7","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"skilo CLI tool","requires_auth":"none","summary":"A malicious skill source can use symbolic links to disclose arbitrary local files, such as SSH keys, when installed via the skilo add command.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\n`skilo add` installs a skill by recursively copying the skill directory into the\ntarget skills directory. The copy routine (`copy_dir_all`) classified each entry\nwith `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and\nthen copied non-directory entries with `std::fs::copy()`, which **does**\ndereference symlinks.\n\nAs a result, a skill containing a symbolic link such as\n`reference.txt -\u003e /home/\u003cuser\u003e/.ssh/id_rsa` was copied as a regular file whose\ncontents are the link's **target**. A malicious skill source — for example a git\nrepository installed via `skilo add github.com/\u003cattacker\u003e/\u003cskills\u003e`, or a local\npath — could read arbitrary files readable by the user running `skilo add` (SSH\nkeys, cloud credentials, `.env` files, etc.) and place their contents inside the\ninstalled skill directory, where the user or their agent may later read, share,\nor sync them.\n\nThis is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)\ntriggered by installing an untrusted skills source.\n\n### Patches\n\nFixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any\nrecursion depth (failing closed with a dedicated error) instead of dereferencing\nthem.\n\n### Workarounds\n\n- Only install skills from sources you trust.\n- Inspect a skill source for symbolic links before running `skilo add`.\n\n### Affected versions\n\nIntroduced together with the `skilo add` command in 0.5.0 and present through\n0.11.0. Releases before 0.5.0 do not include the `add` command.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source","id":"GHSA-6xx4-9wp6-65p7","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["0.11.1"],"introduced":["0.5.0"],"last_affected":[],"package":"skilo","purl":null,"source":"GHSA-6xx4-9wp6-65p7"},{"ecosystem":"crates.io","fixed":["0.11.1"],"introduced":["0.5.0"],"last_affected":[],"package":"skilo","purl":"pkg:cargo/skilo","source":"GHSA-6xx4-9wp6-65p7"}],"products":null,"published":"2026-07-28","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A malicious skill source can use symbolic links to disclose arbitrary local files, such as SSH keys, when installed via the skilo add command.","url":"https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/"}