yamadashy/repomix · error

Skill name cannot consist only of dots

Error message

Skill name cannot consist only of dots

What it means

validateSkillName rejects names composed solely of dots ('.', '..', '...') because such names resolve to the current or parent directory — another path-traversal/invalid-directory guard. Thrown before kebab-case conversion.

Source

Thrown at src/core/skill/skillUtils.ts:34

    .toLowerCase()
    .replace(/-+/g, '-') // Collapse multiple hyphens
    .replace(/^-|-$/g, ''); // Trim leading/trailing hyphens
};

/**
 * Validates and normalizes a skill name.
 * Converts to kebab-case and truncates to 64 characters.
 * Also rejects path traversal attempts.
 */
export const validateSkillName = (name: string): string => {
  // Reject path separators and null bytes to prevent path traversal
  if (name.includes('/') || name.includes('\\') || name.includes('\0')) {
    throw new Error('Skill name cannot contain path separators or null bytes');
  }

  // Reject dot-only names (., .., ...)
  if (/^\.+$/.test(name)) {
    throw new Error('Skill name cannot consist only of dots');
  }

  const kebabName = toKebabCase(name);

  if (kebabName.length === 0) {
    throw new Error('Skill name cannot be empty after normalization');
  }

  return kebabName.substring(0, SKILL_NAME_MAX_LENGTH);
};

/**
 * Converts a string to Title Case.
 * Handles kebab-case, snake_case, and other separators.
 */
const toTitleCase = (str: string): string => {
  return str
    .replace(/[-_]/g, ' ')

View on GitHub (pinned to f465ad9093)

Solutions

1. Sanitize input to strip dot-only values before calling validateSkillName.
2. Provide a fallback default name when the derived name is empty/dots.
3. Fix the source (URL parsing) that produced the dot-only segment.

Example fix

// before
const name = validateSkillName(segment);
// after
const name = /^[.]+$/.test(segment) ? 'default-skill' : validateSkillName(segment);

const safeSegment = (s: string) => (/^[.]+$/.test(s) || s.trim() === '' ? 'default-skill' : s);
const name = validateSkillName(safeSegment(input));

const isUsableSkillName = (s: string): boolean =>
  s.length > 0 && !/^[.]+$/.test(s);

try {
  const name = validateSkillName(input);
} catch (e) {
  if (e.message.includes('consist only of dots')) {
    const name = validateSkillName('default-skill');
  } else throw e;
}

When it happens

Trigger: Calling validateSkillName with '.', '..', or any all-dots string — e.g. a skill name extracted from a URL like 'https://example.com/..' or user input that is just dots.

Common situations: Malicious or degenerate URL inputs used to auto-generate skill names; users submitting dot-names in interactive prompts; templated scripts where a variable came out as '..'.

Related errors

• Skill name cannot contain path separators or null bytes
• Refusing to trust ${configName}: it resolves outside the clo
• Invalid branch or ref name. Name must not start with '-': ${
• Refusing to trust ${configName}: the remote repository's con
• Remote config not trusted

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/0db86b4542988400. Report an issue: GitHub.