crates.io skillctl vulnerabilities

Latest crates.io skillctl CVEs

Newest publication first

1. GHSA-74p7-6h78-gw8p skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

   Published 2026-06-22

   Unknown

   Impact Following the path-safety patches in GHSA-wx3m-whqv-xv47 (v0.1.2), a comprehensive multi-angle audit surfaced five further vulnerabilities, now patched in v0.1.3: source_sha argument injection in git ls-tree (CRITICAL). InstalledSkill.source_sha deserialized from .skills.t...

2. GHSA-wx3m-whqv-xv47 skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion

   Published 2026-06-05

   High·CVSS 7.1

   Impact skillctl 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attacker to: Exfiltrate arbitrary files on the operator's machine by publishing a malicious skills library containing a symlink inside a skill folder (e.g. niania → /home/u...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.