Tencent/WeKnora · error

invalid skill file path: %s

Error message

invalid skill file path: %s

What it means

Path-safety guard in safeSkillRelPath: the trimmed relative path is absolute (or otherwise rejected by the normalization rules, e.g. escaping the skill directory). The check refuses anything that could resolve outside the skill directory; the offending caller-supplied path is interpolated into the message.

Source

Thrown at internal/agent/skills/tenant_source.go:272

	return path.Join(basePath, clean), nil
}

func (s *TenantSkillSource) row(name string) (*types.TenantSkillEntity, error) {
	if row, ok := s.byName[name]; ok {
		return row, nil
	}
	return nil, fmt.Errorf("skill not found: %s", name)
}

// safeSkillRelPath normalises a caller-supplied relative path and refuses
// anything that leaves the skill directory.
func safeSkillRelPath(relativePath string) (string, error) {
	trimmed := strings.TrimSpace(relativePath)
	if trimmed == "" {
		return "", fmt.Errorf("skill file path is required")
	}
	if path.IsAbs(trimmed) {
		return "", fmt.Errorf("invalid skill file path: %s", relativePath)
	}
	clean := path.Clean(trimmed)
	if clean == "." || clean == ".." || strings.HasPrefix(clean, "../") {
		return "", fmt.Errorf("invalid skill file path: %s", relativePath)
	}
	return clean, nil
}

// bundleArchive returns the compressed zip of one skill, downloading it at
// most once per cache lifetime.
func (s *TenantSkillSource) bundleArchive(
	row *types.TenantSkillEntity,
) ([]byte, error) {
	if s.loadBundle == nil {
		return nil, fmt.Errorf("skill bundles are not available in this deployment")
	}

	key := strings.TrimSpace(row.BundleSHA256)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Pass a relative path that stays inside the skill directory (no leading "/", no "..")
2. Strip absolute prefixes client-side before requesting the file
3. Log the rejected path as a potential traversal attempt

When it happens

Trigger: Thrown at internal/agent/skills/tenant_source.go:272 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/85e10c6db0fc4e31. Report an issue: GitHub.