🛡️ Sentinel: [MEDIUM] Fix regex newline injection and broken exclusion logic

src/agent_sync/publish/external_source.py

@@ -199,12 +199,14 @@ def _find_skills_in_repo(cache_path: Path, source: SourceConfig) -> list[SkillSo
 
 def _is_valid_skill_name(name: str) -> bool:
     """Check if skill name is valid.
-    
+
     Valid: lowercase, numbers, hyphens. No leading/trailing/consecutive hyphens.
     """
     import re
+
     # Match: starts with letter, then letters/numbers/hyphens, ends with letter/number
-    pattern = r'^[a-z][a-z0-9]*(-[a-z0-9]+)*$'
+    # Use \Z to prevent newline injection
+    pattern = r"^[a-z][a-z0-9]*(-[a-z0-9]+)*\Z"
     return bool(re.match(pattern, name))
 
 

src/agent_sync/publish/git_publish.py

@@ -30,19 +30,14 @@
 
 def _ignore_func(*patterns):
     """Create a callable that returns a list of filenames to ignore."""
+    import fnmatch
+
     def _ignore(path, names):
         ignored = []
-        for name in names:
-            for pattern in patterns:
-                if pattern.startswith('*.'):
-                    if name.endswith(pattern[1:]):
-                        ignored.append(name)
-                        break
-                elif pattern.startswith('.'):
-                    if name == pattern or name.startswith(pattern.rstrip('/') + '/'):
-                        ignored.append(name)
-                        break
-        return ignored
+        for pattern in patterns:
+            ignored.extend(fnmatch.filter(names, pattern))
+        return set(ignored)
+
     return _ignore
 
 from rich.console import Console

src/agent_sync/publish/local_source.py

@@ -82,12 +82,14 @@ def _create_skill_source(path: Path) -> SkillSource | None:
 
 def _is_valid_skill_name(name: str) -> bool:
     """Check if skill name is valid.
-    
+
     Valid: lowercase, numbers, hyphens. No leading/trailing/consecutive hyphens.
     """
     import re
+
     # Match: starts with letter, then letters/numbers/hyphens, ends with letter/number
-    pattern = r'^[a-z][a-z0-9]*(-[a-z0-9]+)*$'
+    # Use \Z to prevent newline injection
+    pattern = r"^[a-z][a-z0-9]*(-[a-z0-9]+)*\Z"
     return bool(re.match(pattern, name))
 
 

tests/test_skill_validation_sentinel.py

@@ -0,0 +1,26 @@
+
+import unittest
+import sys
+import os
+
+# Add src to sys.path
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..', 'src')))
+
+from agent_sync.publish.local_source import _is_valid_skill_name as local_val
+from agent_sync.publish.external_source import _is_valid_skill_name as external_val
+
+class TestSkillValidationSentinel(unittest.TestCase):
+    def test_newline_injection_local(self):
+        self.assertTrue(local_val("valid-skill-123"))
+        self.assertFalse(local_val("invalid-skill\n"))
+        self.assertFalse(local_val("invalid\nskill"))
+        self.assertFalse(local_val("\ninvalid"))
+
+    def test_newline_injection_external(self):
+        self.assertTrue(external_val("valid-skill-123"))
+        self.assertFalse(external_val("invalid-skill\n"))
+        self.assertFalse(external_val("invalid\nskill"))
+        self.assertFalse(external_val("\ninvalid"))
+
+if __name__ == '__main__':
+    unittest.main()