Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
yusufkaraaslan/skill_seekers
development @ 3b60a3a
6
Fixes
0
CVEs
HIGH
Peak severity
40.0%
Coverage
Highlights
Denial of Service: 3 prior fixes. Scrutinize any change in this area.
src/skill_seekers/mcp/tools/workflow_tools.py: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Resolving and reading workflow tool definitions from the file system has historically been susceptible to directory traversal attacks. Attackers providing malicious workflow names containing path traversal sequences could access files outside the intended directories if canonicalization and strict validation are not applied uniformly.
Path Traversal: The publishing mechanism of the marketplace accepts user-controlled skill names that, if not sanitized via alphanumeric regular expressions, allow manipulating directory destinations via path traversal sequences during file joining.
Denial of Service: Parsing third-party markdown or text strings containing malformed IPv6 brackets triggers unhandled ValueError exceptions in Python 3.14+, rendering the parsing utility and its calling commands vulnerable to application crashes.