N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-74p7-6h78-gw8p

GHSA-74p7-6h78-gw8p: skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Impact

Following the path-safety patches in GHSA-wx3m-whqv-xv47 (v0.1.2), a comprehensive multi-angle audit surfaced five further vulnerabilities, now patched in v0.1.3:

source_sha argument injection in git ls-tree (CRITICAL). InstalledSkill.source_sha deserialized from .skills.toml (committed, PR-mergeable) flowed unvalidated into git ls-tree -r -z <refspec> -- <path>. Because the refspec sits before --, an attacker who slipped a malicious .skills.toml into a PR could set source_sha = "--name-only" / --abbrev=0 / --output=… and corrupt the diff classifier (which drives pull / push destructive decisions), or forge a divergence state to trick push --on-divergence overwrite into clobbering the wrong content.
FIFO / device / socket denial-of-service in copy_dir_all (CRITICAL). The file-type branch only checked is_dir() / is_symlink(); a FIFO inside a skill folder fell through to fs::copy, which blocks indefinitely waiting for a writer. A character device like /dev/zero would read until OOM. Reachable on skillctl add against any adversarial library.
add --dest arbitrary-directory wipe in agent mode (HIGH). --dest accepted absolute paths and .. traversal without validation, so a single invocation skillctl add --dest /Users/victim/.ssh --on-conflict overwrite --skill <maliciously-named> would remove_dir_all arbitrary directories — no .skills.toml round-trip required. Reachable in any non-interactive / agent-driven workflow where flag values may be attacker-supplied.

Miggo Vulnerability Database

→

GHSA-74p7-6h78-gw8p

GHSA-74p7-6h78-gw8p:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
skillctl	rust	< 0.1.3	0.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of commit 28dfce3 revealed fixes for five distinct vulnerabilities in the skillctl tool. The root causes were primarily a lack of input validation and sanitization across different components of the application, leading to a range of security issues from command injection to denial of service and information disclosure.

Argument Injection (CVE-2024-XXXX-1): The source_sha from .skills.toml was used directly in a git ls-tree command. The fix in skillctl::project_config::InstalledSkill::validate now ensures this value is a valid hex SHA, preventing the injection of command-line flags.
Path Traversal (CVE-2024-XXXX-2): The --dest argument in the add command was not validated, allowing an attacker to specify arbitrary paths. The fix in skillctl::commands::add::resolve_destination now prohibits path traversal (..) and absolute paths in non-interactive modes.
Denial of Service & Information Disclosure (CVE-2024-XXXX-3, CVE-2024-XXXX-4): The skillctl::fs_util::copy_dir_all function was vulnerable in two ways. It didn't check for special file types, leading to a DoS when encountering a FIFO or device file. It also didn't check for hardlinks, allowing an attacker to exfiltrate file content. The patch adds checks for both file types and hardlink counts (nlink > 1).
CRLF Injection (CVE-2024-XXXX-5): The application was vulnerable to commit-trailer forgery. Skill names, descriptions, tags, and user-supplied commit messages were not sanitized, allowing newline characters. This could be used to inject fake Co-Authored-By: trailers into commits. The fixes are spread across skillctl::skill::discover and skillctl::commands::push::run, which now use new sanitization functions to validate these inputs.

By identifying the functions where these validation and sanitization checks were added, we can pinpoint the exact locations of the vulnerabilities in the codebase.

Vulnerable functions

skillctl::project_config::InstalledSkill::validate

src/project_config.rs

The function previously did not validate the `source_sha` field deserialized from `.skills.toml`. This allowed an attacker to inject arguments (e.g., `--name-only`) into the `git ls-tree` command, leading to command injection. It also didn't validate the skill `name`, which could lead to commit-message trailer forgery.

skillctl::fs_util::copy_dir_all

src/fs_util.rs

The function did not properly check file types before copying. It would attempt to copy special files like FIFOs or character devices, leading to a denial-of-service by blocking indefinitely or causing an out-of-memory error. It also did not check for hardlinks, allowing an attacker to create a hardlink to a sensitive file (e.g., `~/.ssh/id_rsa`) within a skill directory, which would then be copied and potentially exfiltrated during a `skillctl push`.

skillctl::commands::add::resolve_destination

src/commands/add.rs

The function did not validate the path provided to the `--dest` argument. This allowed the use of absolute paths and path traversal sequences (`..`), enabling an attacker in an agent-driven context to cause an arbitrary directory wipe by providing a malicious destination path.

skillctl::skill::discover

src/skill.rs

The function parsed skill metadata (name, description, tags) from `SKILL.md` files without sanitization. A skill with a newline in its name could be used to forge commit message trailers (e.g., `Co-Authored-By:`), which are trusted by downstream tools. The patch adds validation to drop skills with invalid names and strip invalid tags or descriptions.

skillctl::commands::push::run

src/commands/push.rs

The function took a user-supplied commit message via the `--message` argument without validation. This allowed an attacker to inject control characters (like carriage returns) to forge commit trailers, misleading downstream automation that parses commit messages.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-74p7-6h78-gw8p: skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Impact

GHSA-74p7-6h78-gw8p:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

N/A

N/A

GHSA-74p7-6h78-gw8p: skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Impact

Patches

Workarounds

Credit

Resources

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-74p7-6h78-gw8p: skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Impact

GHSA-74p7-6h78-gw8p:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

N/A

N/A

GHSA-74p7-6h78-gw8p: skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

Impact

Patches

Workarounds

Credit

Resources

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI