Executive brief
Skilo, a tool for managing 'skills' (modular components), contains a vulnerability in its installation process. When a user adds a new skill from an untrusted source, the tool may inadvertently copy sensitive files from the user's local machine—such as SSH keys or cloud credentials—into the skill directory. This occurs because the tool follows symbolic links during the copy process, potentially allowing an attacker to steal private data if a user is tricked into installing a malicious skill.
Technical details
A symbolic link following vulnerability (CWE-59/CWE-61) exists in the `skilo add` command. The `copy_dir_all` routine uses `std::fs::DirEntry::file_type()` to identify entries, which does not follow symlinks, but subsequently uses `std::fs::copy()` for non-directory entries, which does dereference them. An attacker providing a malicious skill source (via Git or local path) can include symlinks pointing to sensitive files like `~/.ssh/id_rsa`. When the user runs `skilo add`, the contents of the linked files are copied as regular files into the target directory. This vulnerability was fixed in version 0.11.1 by rejecting symbolic links during the copy process.
Affected products
- manuelmauro skilo >= 0.5.0, < 0.11.1
Timeline
- 2026-06-08: disclosed
- 2026-07-28: advisory: GitHub Advisory published
- 0.11.1: patched