feat(skills): validate manifest permissions

2026-02-15 10:16:46 -08:00
parent 892668cb2f
commit 9900f41057
4 changed files with 187 additions and 0 deletions
@@ -203,6 +203,28 @@ describe('loadSkill', () => {
    expect(skill).toBeNull();
  });

+  it('returns null when manifest.json has invalid permissions specification', () => {
+    tmpDir = mkdtempSync(join(tmpdir(), 'flynn-test-'));
+    const skillDir = join(tmpDir, 'invalid-permissions');
+    mkdirSync(skillDir);
+    writeFileSync(
+      join(skillDir, 'manifest.json'),
+      JSON.stringify({
+        name: 'invalid-permissions',
+        description: 'Bad permissions',
+        version: '1.0.0',
+        permissions: {
+          fs: { read: 'not-an-array' },
+        },
+      }),
+    );
+    writeFileSync(join(skillDir, 'SKILL.md'), '# Invalid Permissions');
+
+    const skill = loadSkill(skillDir, 'bundled');
+
+    expect(skill).toBeNull();
+  });
+
  it('strips markdown heading markers from inferred description', () => {
    // Positive: a first line like "## My Heading" should become "My Heading".
    tmpDir = mkdtempSync(join(tmpdir(), 'flynn-test-'));