2a6f74027f
Also corrects the Changed fragment: it named three containment exports as the only ones, which stopped being true when the lexical family was added to close DW1/DW9. It now describes one decision resolved two ways, and says why the lexical pair exists rather than leaving a reader to assume it is a weaker alternative to the realpath form. scripts/lint-docs-required.cjs now passes (ok_docs_updated) — it could not evaluate against the mandated pr:0 placeholder. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
562 B
562 B
type, pr
| type | pr |
|---|---|
| Security | 4672 |
Installed capability skills can no longer be redirected or leaked through a symlink — the three install paths that confine a capability skill name relied on a lexical check, which cannot see a symlink. A link planted at the destination let mkdirSync succeed silently and the SKILL.md write land outside the install root, and a link planted at a capability's own SKILL.md was followed by statSync so an outside file's contents were installed as a skill body. All three now refuse to write or read through a link. (#4636)