vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-19 13:11:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: copy SKILL.md as hard copy in dist-runtime to prevent realpath security check failure (#64166)

Browse Source 
SKILL.md files were created as symlinks pointing to dist/, causing
realpathSync() in resolveContainedSkillPath to resolve outside the
dist-runtime/ directory. The security check then rejected the path,
resulting in all 23 plugin skills being skipped at load time.

Add SKILL.md to the shouldCopyRuntimeFile whitelist so it gets a hard
copy instead of a symlink, matching the existing behavior for
package.json and plugin.json files.

Fixes #64138
This commit is contained in:
Sliverp
2026-04-10 15:41:28 +08:00
committed by GitHub
parent d9ad995b77
commit 1bbe66450e
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
scripts/stage-bundled-plugin-runtime.mjs
View File

@@ -79,7 +79,8 @@ function shouldCopyRuntimeFile(sourcePath) {
relativePath.endsWith("/openclaw.plugin.json") ||
relativePath.endsWith("/.codex-plugin/plugin.json") ||
relativePath.endsWith("/.claude-plugin/plugin.json") ||
relativePath.endsWith("/.cursor-plugin/plugin.json")
relativePath.endsWith("/.cursor-plugin/plugin.json") ||
relativePath.endsWith("/SKILL.md")
);
}