Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Co-authored-by: 4pmtong <web_chentong@163.com>
…kit for new worker, description overflow fix
…ping or encoding Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
backend/app/service/chat_service.py
Outdated
| options.project_id, | ||
| key, | ||
| working_directory=working_directory, | ||
| user_id=options.user_id, |
There was a problem hiding this comment.
options.user_id may not match the folder key used by the Electron skills config, which is derived from the email prefix. If they differ, enabled state and agent scope may appear saved in UI but not apply at runtime
|
|
||
| ipcMain.handle('skill-read', async (_event, filePath: string) => { | ||
| try { | ||
| const fullPath = path.isAbsolute(filePath) |
There was a problem hiding this comment.
Can we limit this read target to SKILLS_ROOT. Accepting an absolute path from renderer can read files outside the skills folder. The same guard would also help skill write, delete, and list.
electron/main/index.ts
Outdated
| const directory = await unzipper.Open.file(zipPath); | ||
| for (const file of directory.files as any[]) { | ||
| if (file.type === 'Directory') continue; | ||
| const destPath = path.join(tempDir, file.path); |
There was a problem hiding this comment.
better add a path boundary check before writing this entry? A crafted zip entry path can include parent traversal segments and escape tempDir, so validating that the resolved destination stays inside tempDir would close this gap.
# Conflicts: # src/components/WorkFlow/node.tsx
4 participants
Description
Summary
Introduces a Skills System and adds an Agents tab to the main navigation.
Skills System
Agents Tab
Other
agentMapmoved toagents.tsx; i18n updates; Models page refactored.What is the purpose of this pull request?