fix(skills): enforce per-file and aggregate size caps for imported SKILL.md content

src/main/skills/import-github.ts

@@ -15,6 +15,8 @@ import {
 import {
   resolveGitHubCommitSha,
   fetchGitHubSkills,
+  MAX_SKILL_BYTES,
+  MAX_TOTAL_BYTES,
 } from "../skill-github.js";
 
 interface GitHubImportDeps {
@@ -49,6 +51,11 @@ export function createGitHubImporter({ db, logger, skillFilesDir }: GitHubImport
     markdown: string,
     _inventory: FileInventoryEntry[],
   ): Promise<string> {
+    if (markdown.length * 2 > MAX_SKILL_BYTES) {
+      throw new Error(
+        `SKILL.md exceeds ${MAX_SKILL_BYTES}-byte limit`,
+      );
+    }
     const dir = skillFilesDir(companyId, slug);
     await mkdir(dir, { recursive: true });
     await writeFile(join(dir, "SKILL.md"), markdown, "utf-8");
@@ -83,8 +90,16 @@ export function createGitHubImporter({ db, logger, skillFilesDir }: GitHubImport
     const results: SkillImportResult[] = [];
     const sourceType: SkillSourceType = originalSkillsShUrl ? "skills_sh" : "github";
     const nowTs = new Date().toISOString();
+    let totalMaterializedBytes = 0;
 
     for (const ghSkill of githubSkills) {
+      const skillBytes = Buffer.byteLength(ghSkill.markdown, "utf-8");
+      totalMaterializedBytes += skillBytes;
+      if (totalMaterializedBytes > MAX_TOTAL_BYTES) {
+        throw new Error(
+          `Skill pack exceeded aggregate limit of ${MAX_TOTAL_BYTES} bytes`,
+        );
+      }
       const parsed = parseFrontmatterMarkdown(ghSkill.markdown);
       const rawSlug =
         normalizeSkillSlug(parsed.frontmatter.slug as string | undefined) ??

src/main/skills/import.ts

@@ -17,6 +17,7 @@ import {
   parseSkillImportSource,
 } from "../skill-keys.js";
 import { createGitHubImporter } from "./import-github";
+import { MAX_SKILL_BYTES } from "../skill-github.js";
 
 const BLOCKED_PATH_PREFIXES_UNIX = ["/etc", "/var", "/proc", "/sys", "/dev", "/boot", "/sbin", "/usr/sbin"];
 const BLOCKED_PATH_PREFIXES_WIN = ["C:\\Windows", "C:\\Program Files", "C:\\ProgramData"];
@@ -63,6 +64,11 @@ export function createSkillImporter({ db, profileDir: _profileDir, logger, skill
     markdown: string,
     _inventory: FileInventoryEntry[],
   ): Promise<string> {
+    if (markdown.length * 2 > MAX_SKILL_BYTES) {
+      throw new Error(
+        `SKILL.md exceeds ${MAX_SKILL_BYTES}-byte limit`,
+      );
+    }
     const dir = skillFilesDir(companyId, slug);
     await mkdir(dir, { recursive: true });
     await writeFile(join(dir, "SKILL.md"), markdown, "utf-8");