GHSA-757f-98qv-fvxg: 
JavaScript 취약점 분석 및 완화

Impact

gskill passed the commit pin from skills.toml and the resolved commit from skills-lock.json to git fetch without validating it. git parses options that appear after positional arguments, so a value starting with - was read as an option. For a git source with a local-path URL, a commit of --upload-pack=<command> makes git run <command> on the machine running gskill. Source URLs and refs passed to git fetch and git ls-remote were not checked either. The same commit value names the source's directory in gskill's clone cache, so a value such as ../dir made a directory outside the cache the install source. This affects anyone who runs gskill in a project whose skills.toml or skills-lock.json was written by someone else, for example a cloned repository.

Patches

Fixed in 0.11.1. Commits must be hex object ids of 4 to 64 characters, so documented short pins keep working, and URLs and refs passed to git may not start with -.

Workarounds

Before running gskill in a project you did not write, check that every commit in skills.toml and skills-lock.json is a hex commit id and that no source URL starts with -.