Yi Liu d3aee84499
fix(security): add --ignore-scripts to skills install commands (#14659)
Skills install runs package manager install commands (npm, pnpm, yarn,
bun) without --ignore-scripts, allowing malicious npm packages to
execute arbitrary code via postinstall/preinstall lifecycle scripts
during global installation.

This is inconsistent with the security fix in commit 92702af7a which
added --ignore-scripts to both plugin installs (src/plugins/install.ts)
and hook installs (src/hooks/install.ts). Skills install was overlooked
in that change.

Global install (-g) is particularly dangerous as scripts execute with
the user's full permissions and can modify globally-accessible binaries.
2026-02-13 02:56:35 +09:00
..
2026-02-09 09:58:58 +09:00
2026-01-20 10:51:25 +00:00
2026-01-19 00:34:26 +00:00
2026-02-11 11:46:56 +01:00
2026-01-30 03:16:21 +01:00
2026-01-14 15:02:19 +00:00
2026-02-09 09:58:58 +09:00
2026-02-01 22:23:16 +00:00
2026-02-09 18:56:58 -08:00