Hyeonsang Cho 16877b92fc
fix(skills): confine review_skill_package local targets to the caller (#6580)
* fix(skills): confine review_skill_package local targets to the caller

Local path targets were allowed anywhere under the Gateway cwd or /tmp.
Every documented deployment keeps DEER_FLOW_HOME under the cwd, so a user
who knew another user's id could pass
.deer-flow/users/<id>/skills/custom/<skill> and get that skill's SKILL.md
and references/ back in the model response. The tool is always available,
so skill tool policy could not remove it.

Local targets are now confined to the configured skills root and the
caller's own user directory (resolved from the runtime user id through
make_safe_user_id, like the user-scoped skill storage). skill:// and
inline:// targets are unchanged.

* test(skills): pin dot-dot and sandbox-planted symlink review targets

* docs(changelog): reference #6580

* fix(skills): ignore a review skills root that contains per-user directories

A skills root configured at or above DEER_FLOW_HOME would re-admit every
user's directory as a local review target. Drop such a root and log a
warning instead of trusting it silently.

* test(skills): use the platform temp dir for the shared-temp review case

A hardcoded /tmp does not exist on Windows dev hosts.

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-10-10 08:58:26 +08:00
..