AIKIDO-2026-956109

TL;DR

The sandbox module resolves LocalFile.src and LocalDir.src host paths and reads SKILL.md files during lazy local skill discovery before materializing them into a sandbox workspace. Before the fix these local sources are not constrained to the SDK process base directory, so an absolute or relative source path pointing outside that directory is materialized without restriction. An application that builds a manifest from attacker-influenced source or skill paths can therefore read host files and metadata outside the intended boundary, including by following symlinked ancestors. The fix constrains local sources to the base directory unless explicitly allowed via manifest.extraPathGrants and rejects symlink-escaping skill discovery.