davila7/claude-code-templates · error

Invalid agent name

Error message

Invalid agent name

What it means

POST /api/install-agent validates agentName against the whitelist regex ^[A-Za-z0-9._/-]+$ because the value is passed to a child process. Any character outside letters, digits, dot, underscore, hyphen and slash triggers 400 'Invalid agent name'. This is an intentional command-injection guard.

Source

Thrown at cli-tool/src/sandbox-server.js:234

        tasks: tasks.sort((a, b) => new Date(b.startTime) - new Date(a.startTime))
    });
});

// API endpoint to install agent
app.post('/api/install-agent', async (req, res) => {
    const { agentName } = req.body;

    if (!agentName) {
        return res.status(400).json({
            success: false,
            error: 'Agent name is required'
        });
    }

    // SECURITY: agent names are `category/name` slugs. Reject anything else so a
    // value like "x; rm -rf ~" can never reach the child process.
    if (!/^[A-Za-z0-9._/-]+$/.test(agentName)) {
        return res.status(400).json({
            success: false,
            error: 'Invalid agent name'
        });
    }

    try {
        console.log(chalk.blue('🔧 Installing agent:'), chalk.cyan(agentName));

        // SECURITY: shell:false (default) keeps agentName as a single argv entry —
        // no shell parses it, so metacharacters cannot inject commands.
        const child = spawn(NPX_CMD, ['claude-code-templates@latest', '--agent', agentName, '--yes'], {
            cwd: process.cwd(),
            stdio: ['pipe', 'pipe', 'pipe']
        });
        
        let output = [];
        let error = [];
        

View on GitHub (pinned to a0851ed10c)

Solutions

1. Send the exact kebab-case slug in category/name form, e.g. development-team/frontend-developer
2. Trim whitespace client-side and reject values with spaces or special characters before submitting
3. Verify the slug exists in GET /components.json before calling install

Example fix

// before
{ "agentName": "Frontend Developer" }
// after
{ "agentName": "development-team/frontend-developer" }

const AGENT_SLUG_RE = /^[A-Za-z0-9._/-]+$/;
if (!AGENT_SLUG_RE.test(agentName)) throw new Error('invalid agent slug');

const isValidAgentSlug = (name) => typeof name === 'string' && /^[A-Za-z0-9._/-]+$/.test(name.trim()) && name.trim().length > 0;

When it happens

Trigger: Sending agentName containing spaces, quotes, semicolons, ampersands, or shell metacharacters — e.g. "frontend developer", "x; rm -rf ~", or a value with a trailing newline. Unicode agent names also fail.

Common situations: User pastes a display name with spaces instead of the slug; client doesn't trim the input; attempted (or accidental) shell injection via the API; agent slugs containing non-ASCII characters.

Related errors

• sessionId and message are required
• Please provide a detailed prompt (at least 10 characters)
• Agent name is required
• Invalid workflow hash format. Expected format: #hash
• Invalid hash format: missing encoded data

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/c6ec3be2a6a6972a. Report an issue: GitHub.