2 Commits

Author SHA1 Message Date
sxh
a72c6489da
fix(skills): windows interpreter scripts outside scripts/ escape security scanning (#6321)
* fix(skills): scan Windows interpreter scripts outside scripts/

CODE_SUFFIXES is the single definition of "this file is code" that
skills/AGENTS.md requires the installer and SkillScan to import, but it
listed .ps1 while omitting .bat/.cmd/.vbs/.wsf/.psm1. Those files
outside scripts/ therefore got is_code_file() == False, so SkillScan
skipped them as binaries (zero findings, not even
package-undecodable-script) and the installer never reached the
executable=True guardrail scan.

Add the five Windows interpreter extensions to the shared table so both
surfaces see them on every platform.

Refs #6320

* fix(skills): scan Windows script host sibling formats

---------

Co-authored-by: sxh313 <sxh313@users.noreply.github.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-10-06 07:17:22 +08:00
sxh
4abba38734
fix(skills): recognise eval fixture paths behind an earlier evals segment (#6271)
is_eval_fixture_path returned on the first 'evals' segment, so a path whose
'evals/fixtures/' came after a plain 'evals' segment read as a non-fixture.
Move the 'fixtures' test into the loop condition so every segment is checked.

Co-authored-by: sxh313 <sxh313@users.noreply.github.com>
2026-10-04 20:47:15 +08:00