Summary
Free-form aliases (permitted since #2125 / 4deb90f) can contain path separators that escape the agent commands directory when registered by flat-file agents (claude, gemini, copilot, etc.).
Root cause
`CommandRegistrar._compute_output_name()` returns the alias name unchanged for non-SKILL.md agents:
```python
if agent_config["extension"] != "/SKILL.md":
return cmd_name # alias returned as-is
```
A manifest alias like `../foo` produces:
```
commands_dir / "../foo.md" → escapes commands_dir
```
`alias_file.parent.mkdir(parents=True, exist_ok=True)` will even create the parent directories.
Not affected
SKILL.md agents (codex, kimi) are safe — `_compute_output_name` replaces `.` with `-` and prepends `speckit-`, neutralising traversal sequences.
Suggested fix
Validate alias strings against a safe identifier pattern before writing, or resolve `alias_file` and assert it stays within `commands_dir` before writing.
Discovery
Identified during review of PR #2027.
Summary
Free-form aliases (permitted since #2125 / 4deb90f) can contain path separators that escape the agent commands directory when registered by flat-file agents (claude, gemini, copilot, etc.).
Root cause
`CommandRegistrar._compute_output_name()` returns the alias name unchanged for non-SKILL.md agents:
```python
if agent_config["extension"] != "/SKILL.md":
return cmd_name # alias returned as-is
```
A manifest alias like `../foo` produces:
```
commands_dir / "../foo.md" → escapes commands_dir
```
`alias_file.parent.mkdir(parents=True, exist_ok=True)` will even create the parent directories.
Not affected
SKILL.md agents (codex, kimi) are safe — `_compute_output_name` replaces `.` with `-` and prepends `speckit-`, neutralising traversal sequences.
Suggested fix
Validate alias strings against a safe identifier pattern before writing, or resolve `alias_file` and assert it stays within `commands_dir` before writing.
Discovery
Identified during review of PR #2027.