Dennis-yxchen f845c5f7fb fix(security): harden zip extraction and import_skill against path traversal ... - Add resolve() + is_relative_to() check in _extract_zip() to block nested traversal entries like nested/../../escape.txt - Sanitize server-provided skill name in import_skill() to prevent directory escape via malicious record metadata - Add 6 regression tests covering both attack vectors Closes #17 Co-authored-by: LeftX <xzq-xu@users.noreply.github.com>		2026-03-31 16:23:56 +08:00
..
test_issue3_startup.py	test: add edge case coverage for local skill search	2026-03-31 15:25:08 +08:00
test_zip_path_traversal.py	fix(security): harden zip extraction and import_skill against path traversal	2026-03-31 16:23:56 +08:00