crewAIInc/crewAI · error · SystemExit

Invalid skill reference: org and name must be single, non-em

Error message

Invalid skill reference: org and name must be single, non-empty path segments (no slashes, no '..').

What it means

The final segment of reference validation: org and name must each be a single, non-empty path segment. The code rejects empty segments, values starting with `.`, and values whose `Path(...).parts` length is not 1 (which catches embedded `/`, `..` traversal, and similar), because these strings are joined into local filesystem paths during install.

Source

Thrown at lib/cli/src/crewai_cli/skills/main.py:108

            console.print(
                "[red]Invalid skill reference. Use the format @org/name.[/red]"
            )
            raise SystemExit(1)

        org, name = without_at.split("/", 1)
        if (
            not org
            or not name
            or org.startswith(".")
            or name.startswith(".")
            or len(Path(org).parts) != 1
            or len(Path(name).parts) != 1
        ):
            console.print(
                "[red]Invalid skill reference: org and name must be single, "
                "non-empty path segments (no slashes, no '..').[/red]"
            )
            raise SystemExit(1)

        self._print_current_organization()
        console.print(f"[bold blue]Downloading skill {ref}...[/bold blue]")

        get_response = self.plus_api_client.get_skill(org, name)

        if get_response.status_code == 404:
            console.print(
                f"[red]Skill {ref} not found. Ensure it has been published and you have access.[/red]"
            )
            raise SystemExit(1)
        if get_response.status_code != 200:
            console.print(
                f"[red]Failed to download skill {ref}: {get_response.status_code}[/red]"
            )
            raise SystemExit(1)

        data = get_response.json()

View on GitHub (pinned to 754d7323be)

Solutions

1. Use plain alphanumeric/hyphen segment names: `crewai skill install @org/my-skill`.
2. Remove trailing slashes, dots, and any traversal sequences from the reference.
3. Quote the argument in the shell to prevent glob/expansion from altering it.

Example fix

# before
crewai skill install '@org/../other/name'
# after
crewai skill install @org/other-name

from pathlib import Path

def is_safe_ref(ref: str) -> bool:
    if not ref.startswith("@") or ref[1:].count("/") != 1:
        return False
    org, name = ref[1:].split("/", 1)
    for part in (org, name):
        if not part or part.startswith(".") or len(Path(part).parts) != 1:
            return False
    return True

def is_installable_skill_ref(ref: str) -> bool:
    """True when ref passes every CLI segment check (prefix, slashes, traversal)."""
    return isinstance(ref, str) and is_safe_ref(ref)

When it happens

Trigger: `crewai skill install @/name` or `@org/` (empty segment), `@./name` or `@org/.hidden` (leading dot), `@org/../name` or `@a%2Fb/name` style values that resolve to multiple path parts. Any ref designed to escape or nest the install directory.

Common situations: Shell quoting mistakes that mangle the ref; attempting to install into a hidden directory; malicious or copy-pasted refs from untrusted sources containing traversal sequences; trailing slashes like `@org/name/`.

Related errors

• Invalid skill reference. Use the format @org/name.
• SKILL.md frontmatter must include a 'name' field.
• Blocked path traversal attempt: {member.name!r}
• Blocked unsupported tar member: {member.name!r}
• Blocked link target escaping destination: {member.name!r} ->

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/7e047b89939d90de. Report an issue: GitHub.