# GHSA-wx3m-whqv-xv47: skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion

> Attackers can exfiltrate secrets or delete files via malicious skills libraries or config files in skillctl, requiring user interaction to pull or push.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 5 Jun 2026

## What is GHSA-wx3m-whqv-xv47?

GHSA-wx3m-whqv-xv47 is a path traversal vulnerability in skillctl, published on 5 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

## Impact

`skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attacker to:

1. **Exfiltrate arbitrary files on the operator's machine** by publishing a malicious skills library containing a symlink inside a skill folder (e.g. `niania → /home/user/.aws/credentials`). The symlink fell through `entry.file_type().is_dir()` in `fs_util::copy_dir_all`, was dereferenced by `fs::copy`, and the target's content was copied into the project. A subsequent `skillctl push` would have published the secret to the (possibly public) library — what the reporter called "round-trip path exfiltration".

2. **Delete arbitrary directories outside the project or library root** by crafting a `.skills.toml` with a malicious `destination` or `source_path` field. Both were deserialized as `PathBuf` with zero validation. Because `Path::join` lets an absolute right-hand side replace the base, `destination = "/home/user/.ssh"` made `cwd.join(...)` resolve outside the project; `..` traversal was equally unguarded. Downstream `remove_dir_all` in `replace_folder_contents` then wiped arbitrary writable directories on `skillctl pull` / `push` / `detect`. `.skills.toml` is the exact kind of file teams commit and exchange via PR; a single merged malicious PR was sufficient to weaponise the maintainer's next `skillctl pull --all`.

3. **`detect --target` accepted `..` traversal**, even though absolute paths were rejected. `--target ../../../etc` would have written outside the library root.

4. **Fork-name validation accepted `.` and `..` literally**, so a fork named `..` would have produced a `Path::join` resolving to the parent directory and `fs::rename` could have clobbered it.

## Patches

Fixed in [v0.1.2](https://github.com/umanio-agency/skillctl/releases/tag/v0.1.2):

- Symlinks inside skill folders are hard-rejected at copy time (both top-level source and any descendant entry).
- `.skills.toml` `destination` and `source_path` are validated at load time and reject absolute paths, `..` components, and Windows-prefix components.
- A new `path_safety::safe_join` helper is wired (defense-in-depth) at every destructive call site in `pull.rs` / `push.rs`.
- `detect --target` and the interactive custom-path prompt go through the same `validate_relative_subpath` helper.
- `validate_fork_name` explicitly rejects `.` and `..`.

Threat-model note: the fix is purely lexical (component-level) plus an explicit symlink check at copy time. No filesystem `canonicalize` calls were added, avoiding TOCTOU windows.

## Credit

Reported privately on 2026-05-19 by **firebaguette** via the Umanio Discord (the reporter declined GitHub credit, so this advisory carries no structured credits field).

## Which versions are affected by GHSA-wx3m-whqv-xv47?

2 open source packages ship an affected version, including skillctl.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `skillctl` | crates.io | All versions | 0.1.2 |
| `skillctl` | crates.io | All versions | 0.1.2 |

## How do I fix GHSA-wx3m-whqv-xv47?

Upgrade skillctl to 0.1.2 or later.

## Is GHSA-wx3m-whqv-xv47 being exploited?

There is no known exploitation of GHSA-wx3m-whqv-xv47 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-wx3m-whqv-xv47 and fix it if it is affected.

What it is: GHSA-wx3m-whqv-xv47 is a path traversal vulnerability in skillctl, published on 5 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-wx3m-whqv-xv47 in the wild and no public exploit code.

Affected packages and fixed versions:
- skillctl (crates.io): affected all versions; fixed in 0.1.2
- skillctl (crates.io): affected all versions; fixed in 0.1.2

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/ (Markdown: https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-wx3m-whqv-xv47

---
From sbomify Insights: https://insights.sbomify.com/GHSA-wx3m-whqv-xv47/
Summaries are generated and may contain mistakes; the official description above is the record.