Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
runkids/skillshare
main @ 67bb2c1
16
Fixes
0
CVEs
HIGH
Peak severity
6.7%
Coverage
Highlights
Path Traversal: 8 prior fixes. Scrutinize any change in this area.
cmd/skillshare: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Path validation within the trash-handling mechanism failed to canonicalize coordinates correctly, relying on raw string-prefix matches that allowed directory containment escapes. Safe path resolution requires consistent use of filepath.Abs and filepath.Rel.
Argument Injection: Git configuration commands (e.g., SetRemoteURL, SetOrAddRemote) were vulnerable to flag smuggling via unsanitized remote URLs beginning with leading dashes. System execution commands must strictly separate flags from arguments utilizing input validation and the double-dash ('--') command argument delimiter.
Auth Bypass: The installation and update workflows of tracked repositories bypassed post-action security audits due to fragile error-string matching. If audit-gate integration fails or is skipped, malicious or altered dependencies can bypass supply-chain security checks.