Repository navigation
fix(skills): validate percent-encoded skill names - #1431
tsarlandie-oai wants to merge 3 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
T-config
|
@jamadeo is on triage rotation this week and is the reviewer for this one. Labels come from the PR labeler. Please review the change. Automated triage. Labels are a first pass and the assigned maintainer has the final say. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 94982693ab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if name != self.frontmatter.name { | ||
| let name = self.name(); | ||
| if name.contains(['/', '\\', '?', '#']) | ||
| || !percent_encoding::percent_decode_str(encoded_name).eq(name.bytes()) |
There was a problem hiding this comment.
When one skills/list page contains both skill://team/caf%C3%A9/SKILL.md and skill://team/caf%c3%a9/SKILL.md, this comparison validates both entries against the same café name, but validate_skills records the raw skill.uri strings in its HashSet. The percent-escape hex case does not change the URI, so the server path accepts and returns the same skill twice despite the duplicate check; use a canonicalized URI key (also covering percent-encoded unreserved characters) or reject noncanonical spellings.
Useful? React with 👍 / 👎.
DaleSeo
left a comment
DaleSeo
left a comment
There was a problem hiding this comment.
Thanks for chasing this down, @tsarlandie-oai!
| let name = self.name(); | ||
| if name.contains(['/', '\\', '?', '#']) | ||
| || !percent_decode_str(encoded_name).eq(name.bytes()) | ||
| { |
There was a problem hiding this comment.
The Agent Skills naming rules already forbid those characters and allow only lowercase letters, numbers, and a single hyphen between them. The spec says the name has to follow those rules. Would you rather enforce them here?
| // RFC 3986 §6.2.2 decodes unreserved bytes and uppercases the hex digits in | ||
| // other escapes. Reserved delimiters therefore stay encoded in the key. |
There was a problem hiding this comment.
Can we mention the new encoding pass in the comment?
Motivation and context
Skill::validatecompares a URI segment with the UTF-8 name fromSKILL.mdfrontmatter. A skill namedcafétherefore fails validation withNameMismatchwhen a server advertisesskill://caf%C3%A9/SKILL.md. This came up while reviewing the filesystem catalog in #1409 and also affects servers that construct their own entries.Percent-decode the name segment once and compare its bytes with the frontmatter. Directory separators and query or fragment delimiters are rejected in the name. When checking a listing for duplicate entries, use the same percent-encoding normalization as the manifest checker. This catches equivalent spellings of a skill URI while preserving the advertised URI for reads.
Tests
NameMismatchonmainwith the new Unicode regression test. The fix accepts top-level and nested names with either hex case. Tests also cover invalid UTF-8, double encoding, and an encoded slash.DuplicateSkill. The regression test covers the hex case, an escaped unreserved character, and a literal Unicode name.cargo test -p rmcp --lib --no-default-featurespassed all 191 tests.cargo test -p rmcp --features client --test test_skillspassed all 14 tests.cargo clippy -p rmcp --lib --no-default-features -- -D warningsandcargo +nightly fmt --all -- --checkpassed.café/SKILL.mdappears under the encoded URI and returns the original Markdown throughread_resource.