path-safety Skill
服务端路径安全与文件访问编码规范。在编写文件下载路由、Agent 工具（文件读取/目录列出）、数据连接器/Loader、Workspace 路径操作、沙箱配置时使用。 Published by microsoft in data-formulator.
What is path-safety Skill?
服务端路径安全与文件访问编码规范。在编写文件下载路由、Agent 工具（文件读取/目录列出）、数据连接器/Loader、Workspace 路径操作、沙箱配置时使用。 Published by microsoft in data-formulator. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Documentation
- Design and media
- Security review use cases
- Documentation use cases
Technical details
- Install or run with Copy skill directory
When to use path-safety Skill
- Use it for security review.
- Use it for documentation.
- Use it for design and media.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/data-formulator
- Skill file: .cursor/skills/path-safety/SKILL.md
What it does
服务端路径安全与文件访问编码规范。在编写文件下载路由、Agent 工具（文件读取/目录列出）、数据连接器/Loader、Workspace 路径操作、沙箱配置时使用。
Skill instructions
Path Safety — 服务端安全编码规范 来源：docs/dev-guides/8-path-safety.md（正式开发规范）+ design-docs/issues/002-arbitrary-file-read-audit.md（安全审计复核）。 本文档提炼了 6 条必须遵守的编码规范。违反任一条即可能引入路径穿越（LFI）漏洞。 --- R1. 文件下载：用 ConfinedDir.resolve() + sendfile，禁用 sendfromdirectory 原因：sendfromdirectory(dir, userinput) 内部会对 userinput 二次解析路径，与前置安全检查形成 TOCTOU 不一致。 python ❌ BAD — 安全检查用 resolved target，发送用原始 filename，两次解析不一致 target = (scratchdir / filename).resolve() target.relativeto(scratchdir.resolve()) 检查通过 return sendfromdirectory(str(scratchdir), filename) 再次解析 ✅ GOOD — 检查和发送用同一个 resolved path scratchjail = workspace.confinedscratch target = scratchjail.resolve(filename) return sendfile(target) 直接用已验证的路径 sendfile(Path) 会根据扩展名自动推断 MIME type，无需额外处理。 --- R2. 路径安全检查：用 ConfinedDir，禁止 str.startswith 原因：str(path).startswith(str(root)) 存在前缀碰撞缺陷（如 /workspace vs /workspaceevil）。 python ❌ BAD if not str(resolved).startswith(str(rootresolved) + os.sep): raise ValueError("escape") ✅ GOOD — 统一走 ConfinedDir，内部使用 Path.isrelativeto() jail =
Explore related resources
Frequently asked questions
What is path-safety?
path-safety is a open-source AI agent skill with Copy skill directory. 服务端路径安全与文件访问编码规范。在编写文件下载路由、Agent 工具（文件读取/目录列出）、数据连接器/Loader、Workspace 路径操作、沙箱配置时使用。
Who is path-safety best for?
path-safety is best for reusing agent instructions, scripts, and references, security review workflows, documentation workflows, design and media workflows.
How do I install path-safety?
Install or run path-safety using Copy skill directory. Check path-safety for the latest setup command.
Is path-safety actively maintained?
path-safety may need a closer maintenance check before production use.
Auto-fetched from GitHub.
