Arun Kumar Thiagarajan c372fd1835 fix(security): skip hidden directories in skill template discovery ...

discoverTemplates() scans subdirectories for SKILL.md.tmpl files but
only skips node_modules, .git, and dist. Hidden directories like
.claude/, .agents/, and .codex/ (which contain symlinked skill
installs) were being scanned, allowing a malicious .tmpl in a
symlinked skill to inject into the generation pipeline.

Fix: add !d.name.startsWith('.') to the subdirs() filter. This skips
all dot-prefixed directories, matching the standard convention that
hidden dirs are not source code.

2026-03-24 13:35:27 +05:30

..

resolvers

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

analytics.ts

feat: safety hook skills + skill usage telemetry (v0.7.1) (#189)

2026-03-18 23:57:59 -05:00

dev-skill.ts

feat: Wave 3 — community bug fixes & platform support (v0.11.6.0) (#359)

2026-03-23 22:15:23 -07:00

discover-skills.ts

fix(security): skip hidden directories in skill template discovery

2026-03-24 13:35:27 +05:30

eval-compare.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

eval-list.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

eval-select.ts

feat: diff-based test selection for E2E and LLM-judge evals (v0.6.1.0) (#139)

2026-03-17 18:45:41 -05:00

eval-summary.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

eval-watch.ts

feat: /land-and-deploy, /canary, /benchmark + perf review (v0.7.0) (#183)

2026-03-21 14:31:36 -07:00

gen-skill-docs.ts

feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)

2026-03-23 23:05:22 -07:00

skill-check.ts

feat: Wave 3 — community bug fixes & platform support (v0.11.6.0) (#359)

2026-03-23 22:15:23 -07:00