From b602e93db321bf008f1bab289192865d0e531d88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Tue, 15 Sep 2026 19:56:50 +0800
Subject: [PATCH] =?UTF-8?q?=E6=8B=92=E7=BB=9D=E4=BF=9D=E7=95=99=E8=B7=AF?=
 =?UTF-8?q?=E5=BE=84=E6=AE=B5=E7=9A=84=20Skill=20=E5=90=8D=E7=A7=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

在 DirectProject Skill 校验中拒绝 . 与 ..

阻止 Skill 路径解析通过父目录段逃逸配置根目录
---
 .../src-tauri/src/agent/direct_codex_user_item/validation.rs     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/direct_codex_user_item/validation.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/direct_codex_user_item/validation.rs
index 4e6ddaef0..536f866f0 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/direct_codex_user_item/validation.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/direct_codex_user_item/validation.rs
@@ -40,6 +40,7 @@ pub(crate) fn validate_direct_codex_user_item(
                 let name = name.trim();
                 if name.is_empty()
                     || name.chars().count() > 120
+                    || matches!(name, "." | "..")
                     || name.chars().any(|character| {
                         character.is_control()
                             || character.is_whitespace()