{"record":{"id":"41a51bc6f476ad7e","repo":"Tencent/WeKnora","slug":"invalid-file-path-s","errorCode":null,"errorMessage":"invalid file path: %s","messagePattern":"invalid file path: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/agent/skills/loader.go","lineNumber":213,"sourceCode":"// The filePath should be relative to the skill's base directory\nfunc (l *Loader) LoadSkillFile(skillName, relativePath string) (*SkillFile, error) {\n\t// Get the skill first\n\tskill, ok := l.discoveredSkills[skillName]\n\tif !ok {\n\t\t// Try to load the skill\n\t\tvar err error\n\t\tskill, err = l.LoadSkillInstructions(skillName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"skill not found: %s\", skillName)\n\t\t}\n\t}\n\n\t// Validate and resolve the file path\n\tcleanPath := filepath.Clean(relativePath)\n\n\t// Security: prevent path traversal\n\tif strings.HasPrefix(cleanPath, \"..\") || filepath.IsAbs(cleanPath) {\n\t\treturn nil, fmt.Errorf(\"invalid file path: %s\", relativePath)\n\t}\n\n\tfullPath := filepath.Join(skill.BasePath, cleanPath)\n\n\t// Verify the file is within the skill directory\n\tabsSkillPath, err := filepath.Abs(skill.BasePath)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tabsFilePath, err := filepath.Abs(fullPath)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !strings.HasPrefix(absFilePath, absSkillPath) {\n\t\treturn nil, fmt.Errorf(\"file path outside skill directory: %s\", relativePath)\n\t}\n\n\t// Read the file","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/agent/skills/loader.go#L195-L231","documentation":"Path-traversal security guard in LoadSkillFile: after filepath.Clean, the caller-supplied relative path starts with \"..\" or is absolute. This is an intentional rejection of paths that could escape the skill's base directory — the input at fault is the relativePath argument.","triggerScenarios":"Thrown at internal/agent/skills/loader.go:213 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a path relative to the skill's base directory, e.g. \"scripts/run.sh\" not \"/etc/passwd\" or \"../../secret\"","Normalize client-supplied paths before calling and strip any leading separators or parent references","Treat the error as a security event and log the attempted path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}