Follow-up to #78. util.SafeReadFile uses os.Lstat on the final path component, which blocks symlinked files. But if a directory in the path is a symlink (for example references/ itself pointing outside the skill tree), os.ReadDir follows it and the regular files inside pass the check, so out-of-tree content can still be read and shipped to the LLM judge.
Possible fix: resolve the skill root once with filepath.EvalSymlinks, then verify each candidate path resolves to a location inside that root before reading (containment check), rather than only checking the leaf's file mode.
Follow-up to #78.
util.SafeReadFileusesos.Lstaton the final path component, which blocks symlinked files. But if a directory in the path is a symlink (for examplereferences/itself pointing outside the skill tree),os.ReadDirfollows it and the regular files inside pass the check, so out-of-tree content can still be read and shipped to the LLM judge.Possible fix: resolve the skill root once with
filepath.EvalSymlinks, then verify each candidate path resolves to a location inside that root before reading (containment check), rather than only checking the leaf's file mode.