diegosouzapw/OmniRoute · error

Skill file path contains a restricted segment

Error message

Skill file path contains a restricted segment

What it means

Error "Skill file path contains a restricted segment" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/skills/builtins.ts:74

  // filesystem-safe key from the API key identifier for workspace isolation.
  return createHash("sha256") // lgtm[js/insufficient-password-hash]
    .update(context.apiKeyId || "anonymous")
    .digest("hex")
    .slice(0, 24);
}

function getWorkspaceRoot(context: { apiKeyId: string }) {
  return path.join(resolveDataDir(), "skills", "workspaces", getContextId(context));
}

function resolveWorkspacePath(inputPath: string, context: { apiKeyId: string }) {
  if (path.isAbsolute(inputPath)) {
    throw new Error("Skill file paths must be relative to the skill workspace");
  }

  const segments = inputPath.split(/[\\/]+/).filter(Boolean);
  if (segments.some((segment) => FORBIDDEN_PATH_SEGMENTS.has(segment.toLowerCase()))) {
    throw new Error("Skill file path contains a restricted segment");
  }

  const root = path.resolve(getWorkspaceRoot(context));
  const resolved = path.resolve(root, inputPath);
  const relative = path.relative(root, resolved);
  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
    throw new Error("Skill file path escapes the skill workspace");
  }

  return { root, resolved, relative };
}

function normalizePositiveInteger(value: unknown, fallback: number, max: number) {
  if (value === undefined || value === null) return fallback;
  const parsed = Number(value);
  if (!Number.isInteger(parsed) || parsed <= 0) return fallback;
  return Math.min(parsed, max);
}

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/skills/builtins.ts:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/d18482788d8c9f48. Report an issue: GitHub.