{"record":{"id":"7e047b89939d90de","repo":"crewAIInc/crewAI","slug":"invalid-skill-reference-org-and-name-must-be-sing","errorCode":null,"errorMessage":"Invalid skill reference: org and name must be single, non-empty path segments (no slashes, no '..').","messagePattern":"Invalid skill reference: org and name must be single, non-empty path segments \\(no slashes, no '\\.\\.'\\)\\.","errorType":"console","errorClass":"SystemExit","httpStatus":null,"severity":"error","filePath":"lib/cli/src/crewai_cli/skills/main.py","lineNumber":108,"sourceCode":"            console.print(\n                \"[red]Invalid skill reference. Use the format @org/name.[/red]\"\n            )\n            raise SystemExit(1)\n\n        org, name = without_at.split(\"/\", 1)\n        if (\n            not org\n            or not name\n            or org.startswith(\".\")\n            or name.startswith(\".\")\n            or len(Path(org).parts) != 1\n            or len(Path(name).parts) != 1\n        ):\n            console.print(\n                \"[red]Invalid skill reference: org and name must be single, \"\n                \"non-empty path segments (no slashes, no '..').[/red]\"\n            )\n            raise SystemExit(1)\n\n        self._print_current_organization()\n        console.print(f\"[bold blue]Downloading skill {ref}...[/bold blue]\")\n\n        get_response = self.plus_api_client.get_skill(org, name)\n\n        if get_response.status_code == 404:\n            console.print(\n                f\"[red]Skill {ref} not found. Ensure it has been published and you have access.[/red]\"\n            )\n            raise SystemExit(1)\n        if get_response.status_code != 200:\n            console.print(\n                f\"[red]Failed to download skill {ref}: {get_response.status_code}[/red]\"\n            )\n            raise SystemExit(1)\n\n        data = get_response.json()","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/cli/src/crewai_cli/skills/main.py#L90-L126","documentation":"The final segment of reference validation: org and name must each be a single, non-empty path segment. The code rejects empty segments, values starting with `.`, and values whose `Path(...).parts` length is not 1 (which catches embedded `/`, `..` traversal, and similar), because these strings are joined into local filesystem paths during install.","triggerScenarios":"`crewai skill install @/name` or `@org/` (empty segment), `@./name` or `@org/.hidden` (leading dot), `@org/../name` or `@a%2Fb/name` style values that resolve to multiple path parts. Any ref designed to escape or nest the install directory.","commonSituations":"Shell quoting mistakes that mangle the ref; attempting to install into a hidden directory; malicious or copy-pasted refs from untrusted sources containing traversal sequences; trailing slashes like `@org/name/`.","solutions":["Use plain alphanumeric/hyphen segment names: `crewai skill install @org/my-skill`.","Remove trailing slashes, dots, and any traversal sequences from the reference.","Quote the argument in the shell to prevent glob/expansion from altering it."],"exampleFix":"# before\ncrewai skill install '@org/../other/name'\n# after\ncrewai skill install @org/other-name","handlingStrategy":"validation","validationCode":"from pathlib import Path\n\ndef is_safe_ref(ref: str) -> bool:\n    if not ref.startswith(\"@\") or ref[1:].count(\"/\") != 1:\n        return False\n    org, name = ref[1:].split(\"/\", 1)\n    for part in (org, name):\n        if not part or part.startswith(\".\") or len(Path(part).parts) != 1:\n            return False\n    return True","typeGuard":"def is_installable_skill_ref(ref: str) -> bool:\n    \"\"\"True when ref passes every CLI segment check (prefix, slashes, traversal).\"\"\"\n    return isinstance(ref, str) and is_safe_ref(ref)","tryCatchPattern":null,"preventionTips":["Restrict org/name to `[A-Za-z0-9_-]+` in your own tooling.","Never build refs from untrusted user input without sanitization.","Single-quote CLI args in shell scripts to prevent glob/expansion mangling."],"tags":["cli","validation","security","path-traversal","skill"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}