Fix frontmatter depth-cap bypass and shell-quote server-supplied names in hints - #410
Merged
Merged
Conversation
…erver names in hints The nesting cap in the SKILL.md frontmatter parser was checked only in parseBlock and parseScalarOrFlow, but parseMapping and parseSequence recurse into each other directly, so a frontmatter alternating `- key:` items and same-indent lists reached depth 2400+ and, at ~8.6 MB (inside the 10 MB IPC cap), crashed the CLI with a RangeError instead of the parse error the changelog promised. The check now runs at the top of both functions. The next-step hints printed by skills-get, resources-directory-read and resources-read interpolated the server-supplied skill name and resource URIs unquoted, so a skill named `pdf; curl … | sh #` yielded a hint that ran the injected command when pasted or followed by an agent. All four sites now go through quoteShellArg(), which formatPath() delegates to. Also records the v0.7.0-beta.1 release review in docs/security-review-2026-09.md and corrects the H5 status to partially fixed: profiles created before 0.7 still refresh at whatever authorization server the MCP server points to. Refs #401, #408 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J7TdVXNthTXXbmDtGJ7sYm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small fixes from the v0.7.0-beta.1 release security review, plus the review write-up. A hostile
SKILL.mdcould crash the CLI with a stack overflow despite the 32-level nesting cap, and the copy-paste hints afterskills-get,resources-directory-readandresources-readinterpolated server-supplied names unquoted, so a skill namedpdf; curl … | sh #produced a hint that ran the injected command.parseMappingandparseSequence, which recurse into each other directly and bypassed the check inparseBlock; an 8.6 MB alternating frontmatter now fails with a parse error instead of aRangeError.quoteShellArg()(formatPath()now delegates to it); unit tests cover hostile names and URIs.docs/security-review-2026-09.mdand correct H5 to "partially fixed": profiles created before 0.7 still refresh at whatever authorization server the MCP server points to. Everything else in the addendum is left for follow-ups.Refs #401, #408
🤖 Generated with Claude Code
https://claude.ai/code/session_01J7TdVXNthTXXbmDtGJ7sYm
Generated by Claude Code