Refusing to generate: unsafe skill directory name ${JSON.str

Error message

Refusing to generate: unsafe skill directory name ${JSON.stringify(dirName)}

What it means

Error "Refusing to generate: unsafe skill directory name ${JSON.stringify(dirName)}" thrown in Fission-AI/OpenSpec.

Source

Thrown at scripts/skillssh-shared.mjs:52

        `Refusing to generate: ${join(outDir, entry.name)} is a symlink. Remove it and re-run.`
      );
    }
  }
  for (const entry of entries) {
    if (entry.isDirectory()) {
      rmSync(join(outDir, entry.name), { recursive: true, force: true });
    }
  }
}

/**
 * Create `<outDir>/<dirName>` and return its path, guaranteeing the write
 * target is a real directory contained in outDir — never a path-traversing
 * name and never a symlink that would redirect the write elsewhere.
 */
export function prepareSkillDirectory(outDir, dirName) {
  if (!/^[a-z0-9][a-z0-9-]*$/.test(dirName)) {
    throw new Error(`Refusing to generate: unsafe skill directory name ${JSON.stringify(dirName)}`);
  }
  const skillDir = join(outDir, dirName);
  mkdirSync(skillDir, { recursive: true });
  if (!lstatSync(skillDir).isDirectory()) {
    throw new Error(`Refusing to write through ${skillDir}: not a real directory.`);
  }
  return skillDir;
}

View on GitHub (pinned to 6926ccb18a)

When it happens

Trigger: Thrown at scripts/skillssh-shared.mjs:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Fission-AI/OpenSpec@6926ccb18a (2026-08-25). Data as JSON: /api/errors/23ab971e5c6c45a6. Report an issue: GitHub.