langchain-ai/deepagents · error · SystemExit

Error: {path_error}

Error message

Error: {path_error}

What it means

The resolved skill directory path failed `_validate_skill_path`, meaning the skill name resolves outside the intended skills directory — typically a path-traversal attempt (e.g. a skill name containing `/`, `..`, or absolute-path components). This guard prevents creating skills in arbitrary filesystem locations.

Source

Thrown at libs/code/deepagents_code/skills/commands.py:464

                style=theme.MUTED,
            )
            raise SystemExit(1)
        skills_dir = ensure_project_skills_dir(credentials.project_root)
        if skills_dir is None:
            console.print(
                "[bold red]Error:[/bold red] Could not create project skills directory."
            )
            raise SystemExit(1)
    else:
        skills_dir = ensure_user_skills_dir(agent)

    skill_dir = skills_dir / skill_name

    # Validate the resolved path is within skills_dir
    is_valid_path, path_error = _validate_skill_path(skill_dir, skills_dir)
    if not is_valid_path:
        console.print(f"[bold red]Error:[/bold red] {path_error}")
        raise SystemExit(1)

    if skill_dir.exists():
        if output_format == "json":
            from deepagents_code.output import write_json

            write_json(
                "skills create",
                {
                    "name": skill_name,
                    "path": str(skill_dir),
                    "project": project,
                    "already_existed": True,
                },
            )
            return
        console.print(
            f"Skill '{skill_name}' already exists at {skill_dir}",
            style=theme.MUTED,

View on GitHub (pinned to a1af029e6e)

Solutions

1. Use a name matching the Agent Skills spec: lowercase letters, digits, and hyphens only (e.g. `my-skill`), no slashes or `..`
2. Sanitize/validate any programmatically supplied skill name before invoking the command
3. If you need a nested skill path, create it through the intended skill structure rather than encoding directories in the name

Example fix

// before
dcode skills create "../shared/skill"
// after
dcode skills create "shared-skill"

import re

def is_valid_skill_name(name: str) -> bool:
    return bool(re.fullmatch(r"[a-z0-9]+(-[a-z0-9]+)*", name)) and ".." not in name

assert is_valid_skill_name("my-skill")

def safe_skill_name(name: object) -> str | None:
    if isinstance(name, str) and re.fullmatch(r"[a-z0-9][a-z0-9-]*", name) and "/" not in name:
        return name
    return None

When it happens

Trigger: `dcode skills create` with a `skill_name` such as `../escape`, `a/b`, or `/etc/foo`, causing `skills_dir / skill_name` to resolve outside `skills_dir` per the containment check.

Common situations: Typing a slash-separated name instead of using nested directories as intended, scripting the command with unvalidated user input, or copy-pasting a path as the skill name.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

• Invalid agent name: {agent_name!r}. Agent names can only con
• Cannot combine 'all' with other commands in --shell-allow-li
• cli_max_retries must be >= 0, got {self.cli_max_retries}
• Rubric file {path!r} is empty.
• --rubric must not be empty.

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/5e4c51e64f64c9a2. Report an issue: GitHub.