zeroclaw-labs/zeroclaw · error · anyhow::Error

Skill name '{}' is unsafe as a path component

Error message

Skill name '{}' is unsafe as a path component

What it means

Error "Skill name '{}' is unsafe as a path component" thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-runtime/src/skillforge/integrate.rs:163

        .replace('\u{0C}', "\\f")
}

/// Sanitize a string for use as a single path component.
/// Rejects empty names, "..", and names containing path separators or NUL.
fn sanitize_path_component(name: &str) -> Result<String> {
    let trimmed = name.trim().trim_matches('.');
    if trimmed.is_empty() {
        bail!("Skill name is empty or only dots after sanitization");
    }
    let sanitized: String = trimmed
        .chars()
        .map(|c| match c {
            '/' | '\\' | '\0' => '_',
            _ => c,
        })
        .collect();
    if sanitized == ".." || sanitized.contains('/') || sanitized.contains('\\') {
        bail!("Skill name '{}' is unsafe as a path component", name);
    }
    Ok(sanitized)
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;
    use crate::skillforge::scout::{ScoutResult, ScoutSource};
    use std::fs;

    fn sample_candidate() -> ScoutResult {
        ScoutResult {
            name: "test-skill".into(),
            url: "https://github.com/user/test-skill".into(),

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Use a skill name that is a safe single path component (no separators, '..', or special characters).

When it happens

Trigger: Thrown at crates/zeroclaw-runtime/src/skillforge/integrate.rs:163 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/9d17fbe89eedb9db. Report an issue: GitHub.