skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source
skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine (copy_dir_all) classified each entry with std::fs::DirEntry::file_type() — which does not follow symlinks — and then copied non-directory entries with std::fs::copy(), which does dereference symlinks. As a result, a skill containing a symbolic link such as reference.txt -> /home/<user>/.ssh/id_rsa was copied as a regular file whose contents are the link's target. A …