vercel/ai · error · Error

Invalid Cline skill file path for ${skillName}: ${filePath}

Error message

Invalid Cline skill file path for ${skillName}: ${filePath}

What it means

normalizeSkillFilePath sanitizes each file path declared by a Cline skill, rejecting paths that are empty-ish ('.'), absolute, or escape the skill directory ('..', '/../', trailing '/..'). This prevents skills from referencing files outside their own directory. The thrown message includes the offending skill name and raw path.

Source

Thrown at packages/harness-cline/src/cline-skills.ts:152

}

function normalizeSkillFilePath({
  skillName,
  filePath,
}: {
  skillName: string;
  filePath: string;
}): string {
  const normalized = path.posix.normalize(filePath);
  if (
    normalized === '' ||
    normalized === '.' ||
    normalized.startsWith('../') ||
    normalized.includes('/../') ||
    normalized.endsWith('/..') ||
    path.posix.isAbsolute(normalized)
  ) {
    throw new Error(
      `Invalid Cline skill file path for ${skillName}: ${filePath}`,
    );
  }
  return normalized;
}

function renderSkillInstructions({
  skill,
  args,
}: {
  skill: ProjectedClineSkill;
  args: string | undefined;
}): string {
  const trimmedArgs = args?.trim();
  const argsTag = trimmedArgs
    ? `\n<command-args>${trimmedArgs}</command-args>`
    : '';
  const description = skill.description.trim()

View on GitHub (pinned to 69428b1f8b)

Solutions

1. Rewrite the file path as a relative path inside the skill's own directory (no leading '/', no '..').
2. Copy referenced external files into the skill directory and reference them relatively.
3. Remove '.' or '..' entries from the skill's declared file list.

Example fix

// before
files: ["/usr/share/prompts/review.md"]
// after
files: ["prompts/review.md"] // file copied into the skill directory

function assertSafeSkillPath(p) {
  if (!p || p === '.' || p.startsWith('/') || p.startsWith('../') || p.includes('/../') || p.endsWith('/..')) {
    throw new Error(`unsafe skill file path: ${p}`);
  }
}

try {
  await projectSkills(skill);
} catch (e) {
  if (/Invalid Cline skill file path/.test(String(e?.message))) {
    // fix the offending path reported in the message
  } else throw e;
}

When it happens

Trigger: A skill declares a file path that is absolute (e.g. '/etc/passwd'), starts with '../', contains '/../' in the middle, ends with '/..', or equals '.'.

Common situations: Skill authors using absolute paths to reference shared assets; symlinks or relative references intended to reach a sibling skill's files; Windows-style absolute paths pasted into SKILL.md frontmatter.

Related errors

• Duplicate Cline skill name: ${skill.name}
• Duplicate Cline skill identifier: ${id}
• Sandbox workspace mirror received an invalid relative path:
• Invalid skill name: ${name}
• Invalid argument for parameter model: model ${model.provider

AI-assisted analysis of vercel/ai@69428b1f8b (2026-08-30). Data as JSON: /api/errors/6e4b684bdf8eaf62. Report an issue: GitHub.