vercel-labs/skills · error

Archive contains too many files

Error message

Archive contains too many files

What it means

A second extraction cap: the provider allows at most MAX_ARCHIVE_FILES entries. When files.size reaches the cap and another file entry arrives, 'Archive contains too many files' is thrown, preventing file-count bombs.

Source

Thrown at src/providers/wellknown.ts:710

    return parts.join('/');
  }

  private addArchiveFile(
    files: Map<string, WellKnownFileContent>,
    path: string,
    content: Uint8Array,
    runningTotal: { bytes: number }
  ) {
    const normalizedPath = this.normalizeArchivePath(path);
    if (!normalizedPath) throw new Error(`Unsafe archive path: ${path}`);

    runningTotal.bytes += content.byteLength;
    if (runningTotal.bytes > MAX_ARCHIVE_UNPACKED_BYTES) {
      throw new Error('Archive exceeds maximum unpacked size');
    }
    if (files.size >= MAX_ARCHIVE_FILES) {
      throw new Error('Archive contains too many files');
    }

    files.set(normalizedPath, content);
  }

  private extractTarGz(bytes: Uint8Array): Map<string, WellKnownFileContent> {
    const tar = gunzipSync(Buffer.from(bytes));
    const files = new Map<string, WellKnownFileContent>();
    const runningTotal = { bytes: 0 };
    let offset = 0;

    while (offset + 512 <= tar.length) {
      const header = tar.subarray(offset, offset + 512);
      if (header.every((byte) => byte === 0)) break;

      const name = this.readTarString(header, 0, 100);
      const sizeText = this.readTarString(header, 124, 12).trim();
      const typeFlag = header[156];

View on GitHub (pinned to 435076e789)

Solutions

1. Repack excluding junk: tar -czf skill.tar.gz --exclude=.git --exclude=node_modules .
2. Audit entry count locally: tar -tf artifact.tar.gz | wc -l
3. Keep the artifact to SKILL.md plus a small set of reference files
4. Verify you're fetching the intended artifact, not a whole-repo snapshot

Example fix

# before
tar -czf skill.tar.gz .            # includes .git and node_modules
# after
tar -czf skill.tar.gz --exclude=.git --exclude=node_modules .

const entryCount = await countArchiveEntries(artifactUrl); // e.g. stream tar headers
if (entryCount > 5000) throw new Error(`Artifact has ${entryCount} entries; too many`);

function isTooManyFiles(e: unknown): e is Error {
  return e instanceof Error && /too many files/i.test(e.message);
}

try { await provider.fetchArtifact(url); }
catch (e) {
  if (isTooManyFiles(e)) { logger.warn(`Skipping bloated artifact ${url}`); return null; }
  throw e;
}

When it happens

Trigger: A registry archive whose entry count exceeds MAX_ARCHIVE_FILES — e.g. a skill bundling node_modules, .git objects, or generated file trees with tens of thousands of entries.

Common situations: Packaging mistakes that forget to exclude .git/node_modules; malicious archives padded with empty files; build outputs accidentally included.

Related errors

• Archive exceeds maximum unpacked size
• Unsafe archive path: ${path}
• Archive links are not supported
• Archive contains too many files (${state.entries}). Maximum
• Archive contains unsafe path: ${path}

AI-assisted analysis of vercel-labs/skills@435076e789 (2026-08-28). Data as JSON: /api/errors/91506a572ec75963. Report an issue: GitHub.