Infinite recursive folders trying to skillshare install ./ -p on Windows

[druellan]

Hey, this happened today on version v0.20.15 on Windows 10, fully patched.
I tried to install skillshare in a project with skillshare install ./ -p
This caused the ./skillshare folder' being created just fine, but inside the .skills` it started to create a recursive structure so long that Windows flagged it as a virus.

I'm not posting this as an issue because I'm not going to try replicate it (it was kind of scary to be honest), but might be something you guys want to check.

[runkids]

Thank you for reporting this — and sorry, that is genuinely scary.

I was able to confirm the failure mode from your command, so please don’t try to reproduce it again.

Root cause: in project mode, skillshare install ./ -p can create .skillshare/skills/... inside the same directory tree that is being copied. On Windows, the directory walker can then see the newly-created destination as part of the source and recursively copy it into itself, creating an extremely deep .skillshare/skills/... structure. This is not malware, but it is absolutely a serious bug.

I’ve added regression coverage and fixed it in two ways:

1. skillshare install ./ -p now rejects installing the project root into itself and tells the user to install a specific skill subdirectory instead.
2. The lower-level copy routine now also skips the destination subtree as a safety guard, so this class of recursive self-copy cannot happen elsewhere.

Workaround for v0.20.15: avoid skillshare install ./ -p; use a specific skill directory instead, e.g.

skillshare install ./my-skill -p

I’ll ship this in the next patch release and update this discussion when it’s available. Thanks again for the report, and sorry for the scare.

[runkids]

Update: this has been fixed and released in v0.20.17.

I verified the original command on Windows now fails safely instead of creating the recursive .skillshare/skills/... tree.

skillshare install ./ -p now rejects installing the project root into itself. Please use a specific skill subdirectory instead, for example:

skillshare install ./my-skill -p

The copy layer also now skips destination subtrees as a defense-in-depth guard.

Thanks again for reporting this — and sorry for the scare.

[druellan]

Nice! Thanks, and glad you managed to find the issue.