fix: harden skill trust source matching (#31229)

Co-authored-by: gaia <gaia@gaia.local>
This commit is contained in:
Jorge Fuenmayor 2026-05-25 03:51:15 -05:00 committed by GitHub
parent 2d422720b5
commit 93660643a6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 78 additions and 8 deletions

View file

@ -550,7 +550,14 @@ def do_install(identifier: str, category: str = "", force: bool = False,
# Scan
c.print("[bold]Running security scan...[/]")
scan_source = getattr(bundle, "identifier", "") or getattr(meta, "identifier", "") or identifier
if bundle.source == "official":
scan_source = "official"
else:
scan_source = (
getattr(bundle, "identifier", "")
or getattr(meta, "identifier", "")
or identifier
)
result = scan_skill(q_path, source=scan_source)
c.print(format_scan_report(result))