# GHSA-6xx4-9wp6-65p7: skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

> A malicious skill source can use symbolic links to disclose arbitrary local files, such as SSH keys, when installed via the skilo add command.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 28 Jul 2026

## What is GHSA-6xx4-9wp6-65p7?

GHSA-6xx4-9wp6-65p7 is a path traversal vulnerability in skilo, published on 28 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

### Impact

`skilo add` installs a skill by recursively copying the skill directory into the
target skills directory. The copy routine (`copy_dir_all`) classified each entry
with `std::fs::DirEntry::file_type()` — which does **not** follow symlinks — and
then copied non-directory entries with `std::fs::copy()`, which **does**
dereference symlinks.

As a result, a skill containing a symbolic link such as
`reference.txt -> /home/<user>/.ssh/id_rsa` was copied as a regular file whose
contents are the link's **target**. A malicious skill source — for example a git
repository installed via `skilo add github.com/<attacker>/<skills>`, or a local
path — could read arbitrary files readable by the user running `skilo add` (SSH
keys, cloud credentials, `.env` files, etc.) and place their contents inside the
installed skill directory, where the user or their agent may later read, share,
or sync them.

This is arbitrary local file disclosure (CWE-59 / CWE-61, symlink following)
triggered by installing an untrusted skills source.

### Patches

Fixed in **0.11.1**. `copy_dir_all` now rejects symbolic-link entries at any
recursion depth (failing closed with a dedicated error) instead of dereferencing
them.

### Workarounds

- Only install skills from sources you trust.
- Inspect a skill source for symbolic links before running `skilo add`.

### Affected versions

Introduced together with the `skilo add` command in 0.5.0 and present through
0.11.0. Releases before 0.5.0 do not include the `add` command.

## Which versions are affected by GHSA-6xx4-9wp6-65p7?

2 open source packages ship an affected version, including skilo.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `skilo` | crates.io | From 0.5.0 | 0.11.1 |
| `skilo` | crates.io | From 0.5.0 | 0.11.1 |

## How do I fix GHSA-6xx4-9wp6-65p7?

Upgrade skilo to 0.11.1 or later.

## Is GHSA-6xx4-9wp6-65p7 being exploited?

There is no known exploitation of GHSA-6xx4-9wp6-65p7 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-6xx4-9wp6-65p7 and fix it if it is affected.

What it is: GHSA-6xx4-9wp6-65p7 is a path traversal vulnerability in skilo, published on 28 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-6xx4-9wp6-65p7 in the wild and no public exploit code.

Affected packages and fixed versions:
- skilo (crates.io): affected from 0.5.0; fixed in 0.11.1
- skilo (crates.io): affected from 0.5.0; fixed in 0.11.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/ (Markdown: https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-6xx4-9wp6-65p7

---
From sbomify Insights: https://insights.sbomify.com/GHSA-6xx4-9wp6-65p7/
Summaries are generated and may contain mistakes; the official description above is the record.