From 87cbcc9875cecc867b4a7e8807fe129d5e81d7f6 Mon Sep 17 00:00:00 2001 From: camera-2018 <40380042+camera-2018@users.noreply.github.com> Date: Thu, 26 Feb 2026 08:03:44 +0000 Subject: [PATCH] fix(neo): sanitize skill name in frontmatter to prevent injection Sanitize the `name` field in `SKILL.md` frontmatter to remove newlines and control characters. This prevents potential frontmatter injection vulnerabilities where a malicious skill name could introduce arbitrary YAML fields or corrupt the file structure. - Modified `_ensure_skill_frontmatter` in `astrbot/core/skills/neo_skill_sync.py` to normalize whitespace in `name`. - Ensured `name` is cast to string before splitting to handle non-string inputs safely. --- astrbot/core/skills/neo_skill_sync.py | 1 + 1 file changed, 1 insertion(+) diff --git a/astrbot/core/skills/neo_skill_sync.py b/astrbot/core/skills/neo_skill_sync.py index 0e393b28c..5fe2b7832 100644 --- a/astrbot/core/skills/neo_skill_sync.py +++ b/astrbot/core/skills/neo_skill_sync.py @@ -95,6 +95,7 @@ def _ensure_skill_frontmatter(markdown: str, *, skill_name: str, skill_key: str) frontmatter, body = _parse_frontmatter(markdown) name = frontmatter.get("name") or skill_name + name = " ".join(str(name).split()) description = frontmatter.get("description") or _derive_description(body) if not description: description = f"Synced skill for `{skill_key}`."