diegosouzapw/OmniRoute · error

Skill file path escapes the skill workspace

Error message

Skill file path escapes the skill workspace

What it means

Error "Skill file path escapes the skill workspace" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/lib/skills/builtins.ts:81

function getWorkspaceRoot(context: { apiKeyId: string }) {
  return path.join(resolveDataDir(), "skills", "workspaces", getContextId(context));
}

function resolveWorkspacePath(inputPath: string, context: { apiKeyId: string }) {
  if (path.isAbsolute(inputPath)) {
    throw new Error("Skill file paths must be relative to the skill workspace");
  }

  const segments = inputPath.split(/[\\/]+/).filter(Boolean);
  if (segments.some((segment) => FORBIDDEN_PATH_SEGMENTS.has(segment.toLowerCase()))) {
    throw new Error("Skill file path contains a restricted segment");
  }

  const root = path.resolve(getWorkspaceRoot(context));
  const resolved = path.resolve(root, inputPath);
  const relative = path.relative(root, resolved);
  if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
    throw new Error("Skill file path escapes the skill workspace");
  }

  return { root, resolved, relative };
}

function normalizePositiveInteger(value: unknown, fallback: number, max: number) {
  if (value === undefined || value === null) return fallback;
  const parsed = Number(value);
  if (!Number.isInteger(parsed) || parsed <= 0) return fallback;
  return Math.min(parsed, max);
}

function sanitizeHeaders(headers: unknown) {
  if (!headers || typeof headers !== "object" || Array.isArray(headers)) return undefined;

  const sanitized: Record<string, string> = {};
  for (const [key, value] of Object.entries(headers as Record<string, unknown>)) {
    const normalizedKey = key.trim();

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/lib/skills/builtins.ts:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/75212ffe6ef9eaf3. Report an issue: GitHub.