{"action":"Upgrade skilo to 0.11.1 or later.","affected":[{"fixed":"0.11.1","introduced":"0.5.0"}],"component":"skilo","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["0.11.1"],"ghsa_id":"GHSA-6xx4-9wp6-65p7","id":"tcs_01M5KETXRYRGGCS8Q7H54F64K8","modified_at":"2026-07-28T22:30:30.937595729Z","published_at":"2026-07-28T22:23:48Z","references":["https://osv.dev/vulnerability/GHSA-6xx4-9wp6-65p7","https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7","https://github.com/manuelmauro/skilo/pull/11","https://github.com/manuelmauro/skilo/commit/c14bdc2eddcf26633ab1dcc0b2d5c0ff42c72a3e","https://github.com/manuelmauro/skilo","https://github.com/manuelmauro/skilo/releases/tag/v0.11.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-6xx4-9wp6-65p7","url":"https://osv.dev/vulnerability/GHSA-6xx4-9wp6-65p7"}],"summary":"skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source"}