Dennis-yxchen f845c5f7fb fix(security): harden zip extraction and import_skill against path traversal ... - Add resolve() + is_relative_to() check in _extract_zip() to block nested traversal entries like nested/../../escape.txt - Sanitize server-provided skill name in import_skill() to prevent directory escape via malicious record metadata - Add 6 regression tests covering both attack vectors Closes #17 Co-authored-by: LeftX <xzq-xu@users.noreply.github.com>		2026-03-31 16:23:56 +08:00
..
agents	fix: rename platform package to platforms	2026-03-26 00:09:50 +08:00
cloud	fix(security): harden zip extraction and import_skill against path traversal	2026-03-31 16:23:56 +08:00
config	initial commit	2026-03-24 16:03:22 +08:00
grounding	fix: rename platform package to platforms	2026-03-26 00:09:50 +08:00
host_detection	initial commit	2026-03-24 16:03:22 +08:00
host_skills	docs: update openclaw setup instructions in host_skills README	2026-03-28 10:53:53 +08:00
llm	initial commit	2026-03-24 16:03:22 +08:00
local_server	initial commit	2026-03-24 16:03:22 +08:00
platforms	fix: rename platform package to platforms	2026-03-26 00:09:50 +08:00
prompts	initial commit	2026-03-24 16:03:22 +08:00
recording	fix: rename platform package to platforms	2026-03-26 00:09:50 +08:00
skill_engine	docs: update register_skill_dir docstring to reflect idempotent return	2026-03-31 14:58:01 +08:00
skills	initial commit	2026-03-24 16:03:22 +08:00
utils	initial commit	2026-03-24 16:03:22 +08:00
.env.example	initial commit	2026-03-24 16:03:22 +08:00
__init__.py	initial commit	2026-03-24 16:03:22 +08:00
__main__.py	fix: CLI entry point now respects OPENSPACE_MODEL and OPENSPACE_LLM_* env vars	2026-03-31 15:36:13 +08:00
dashboard_server.py	initial commit	2026-03-24 16:03:22 +08:00
mcp_server.py	Refresh local registry for local skill search	2026-03-31 15:20:23 +08:00
tool_layer.py	initial commit	2026-03-24 16:03:22 +08:00