iflytek/astron-agent · error · ValueError

Path must stay inside the Skill workspace

Error message

Path must stay inside the Skill workspace

What it means

_normalize_relative_path normalizes a caller-supplied relative path with posixpath.normpath and rejects any result that is absolute ('/...'), equal to '..', or starting with '../'. It raises ValueError('Path must stay inside the Skill workspace') to block path-traversal out of the skill workspace directory.

Solutions

1. Strip any workspace prefix and pass only a workspace-relative path (e.g. 'output' instead of '/home/user/skill/output')
2. Remove leading '../' segments and leading slashes from the configured path
3. Sanitize user-supplied paths before passing them into the skill request
4. Use forward slashes and relative segments only

Example fix

// before
working_dir = '/home/user/skill/output'
// after
working_dir = 'output'

import posixpath
def assert_safe_relpath(p: str) -> str:
    n = posixpath.normpath(str(p or '').strip().replace('\\', '/'))
    if n.startswith('/') or n == '..' or n.startswith('../'):
        raise ValueError('Path must stay inside the Skill workspace')
    return n
assert_safe_relpath(user_path)

def is_safe_relpath(p: str) -> bool:
    n = posixpath.normpath(str(p or '').strip().replace('\\', '/'))
    return bool(n) and n != '.' and not n.startswith('/') and not n.startswith('..')

try:
    rel = provider._normalize_relative_path(user_path, default='.')
except ValueError:
    rel = '.'
    logger.warning('unsafe path rejected, falling back to workspace root')

When it happens

Trigger: Passing a path like '/etc/passwd', '../secret', '..', or a Windows-style path that normalizes to escape the workspace (e.g. '..\\..\\x' becomes '../x') to any API that resolves paths relative to the skill workspace.

Common situations: Hardcoded config from another environment using absolute paths; user-controlled workflow parameters carrying '../'; mixing Windows backslash separators; copy-pasted container paths like '/home/user/skill/out'.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Only HTTP and HTTPS remote resources are allowed
• Remote resource size limit is invalid
• Remote resource URL must not include user information
• Skill resource is unavailable
• Tool path parameter is unsafe

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/a86818fdebd304e7. Report an issue: GitHub.

Appendix: source

Thrown at core/agent/service/plugin/skill_sandbox.py:531

        return PluginResponse(
            result={
                "skill_id": self.skill_id,
                "configured": False,
                "message": SCRIPT_SANDBOX_UNCONFIGURED_MESSAGE,
            }
        )

    def _normalize_relative_path(self, value: Any, default: str) -> str:
        path = str(value or default).strip().replace("\\", "/")
        if not path or path == ".":
            return "."
        normalized = posixpath.normpath(path)
        if (
            normalized.startswith("/")
            or normalized == ".."
            or normalized.startswith("../")
        ):
            raise ValueError("Path must stay inside the Skill workspace")
        return normalized


class SkillSandboxConfig(BaseModel):
    enabled: bool = False
    workflow_id: str = ""
    run_id: str = ""
    node_id: str = ""
    uid: str = ""
    space_id: str = ""


class SandboxExecutionRequest(BaseModel):
    skill_id: str
    command: str
    stdin: Any = None
    working_dir: str = "."
    output_dir: str = "output"

View on GitHub (pinned to 5e758547a8)