Hmbown/CodeWhale · error · anyhow::Error

refusing to import unsafe external skill package

Error message

refusing to import unsafe external skill package

What it means

Raised in import_external when the audited source package is flagged path_unsafe. The audit marks a package path-unsafe when it contains symlinks or otherwise escapes its expected root; import refuses to copy such packages as a security fail-closed measure before any filesystem write.

Source

Thrown at crates/tui/src/skills/mutation.rs:654

            after_digest: None,
            outcome: SkillMutationOutcome::NetworkDenied(host),
        }),
    }
}

fn import_external(
    source_id: AuditedSkillId,
    expected_digest: String,
    target: SkillTargetScope,
    conflict_policy: ConflictPolicy,
    ctx: &MutationContext<'_>,
) -> Result<SkillMutationReceipt> {
    let (source_skill, source_path) = find_audited_skill(ctx, &source_id)?;
    if source_skill.source_kind != SkillSourceKind::CompatibleExternal {
        bail!("import source must be a compatible external skill");
    }
    if source_skill.path_unsafe {
        bail!("refusing to import unsafe external skill package");
    }

    let owned_snap = scan_with_configured(
        ctx.workspace,
        ctx.home,
        ctx.configured_skills_dir,
        SkillAuditMode::OwnedOnly,
        None,
    );
    let owned_has_name = owned_snap
        .skills
        .iter()
        .any(|s| s.id.canonical_name == source_id.canonical_name);

    if !owned_has_name && !source_skill.import_candidate {
        bail!("skill is not an import candidate");
    }

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Inspect the external skill directory for symlinks or unexpected path structures and replace them with regular files
2. Re-install or re-download the external skill package from its origin
3. Re-scan so the audit clears the path_unsafe flag, then retry the import

When it happens

Trigger: Thrown at crates/tui/src/skills/mutation.rs:654 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/2f2a6b5170a7580a. Report an issue: GitHub.