mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-08 13:12:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

chore: debug log for untrusted absolute skill paths; drop misleading test patch

Browse source 
Review findings: (a) an absolute path outside trusted roots passes
through unchanged and gets rejected downstream by skill_view — add a
debug log at the pass-through so the cron 'skill not found' symptom is
diagnosable next time; (b) test_relative_path_unchanged patched
get_skills_dir although the relative branch early-returns before any
root lookup — drop the misleading patch.
This commit is contained in:
kshitijk4poor 2026-07-07 14:34:12 +05:30 • committed by kshitij
parent 713e50e7d2
commit 2c5762f575
2 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
agent/skill_utils.py
View file

@ -556,6 +556,11 @@ def normalize_skill_lookup_name(identifier: str) -> str:
try:
return str(identifier_path.resolve().relative_to(primary_root.resolve()))
except Exception:
logger.debug(
"Skill identifier %r is an absolute path outside trusted skills "
"roots — passing through unchanged (skill_view will reject it)",
raw_identifier,
)
return raw_identifier

2
tests/agent/test_skill_utils.py
View file

@ -339,7 +339,7 @@ class TestNormalizeSkillLookupName:
def test_relative_path_unchanged(self, tmp_path, monkeypatch):
from agent.skill_utils import normalize_skill_lookup_name
monkeypatch.setattr("agent.skill_utils.get_skills_dir", lambda: tmp_path / "skills")
# Relative identifiers early-return before any root lookup.
assert normalize_skill_lookup_name("foo/bar") == "foo/bar"
def test_absolute_under_skills_dir_becomes_relative(self, tmp_path, monkeypatch):