Commit graph

5 commits

Author SHA1 Message Date
Harry
906ae1e989
Merge f2d144781d into b0021b46bb 2026-04-06 15:25:07 +03:00
spidercatfly
e1a8524475 feat: migrate cloud search to server-side embedding endpoint 2026-04-02 23:17:44 +08:00
Dennis-yxchen
f845c5f7fb fix(security): harden zip extraction and import_skill against path traversal
- Add resolve() + is_relative_to() check in _extract_zip() to block
  nested traversal entries like nested/../../escape.txt
- Sanitize server-provided skill name in import_skill() to prevent
  directory escape via malicious record metadata
- Add 6 regression tests covering both attack vectors

Closes #17

Co-authored-by: LeftX <xzq-xu@users.noreply.github.com>
2026-03-31 16:23:56 +08:00
Harry
f2d144781d
Enhance embedding generation with response validation
Added validation for API response structure and improved error handling for embedding generation.
2026-03-25 23:26:42 +08:00
spidercatfly
6ff4861f88 initial commit 2026-03-24 16:03:22 +08:00