feat: add support for adding agent skills from private github repos#2295
feat: add support for adding agent skills from private github repos#2295ashishSoni1234 wants to merge 1 commit into
Conversation
|
@ashishSoni1234 is attempting to deploy a commit to the Different AI Team on Vercel. A member of the Team first needs to authorize it. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 7 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="apps/server/src/skill-hub.ts">
<violation number="1" location="apps/server/src/skill-hub.ts:113">
P1: Catalog cache key omits authentication context, so private repo listings fetched with a PAT can be served to later unauthenticated requests for the same owner/repo/ref.</violation>
</file>
<file name="apps/server/src/server.ts">
<violation number="1" location="apps/server/src/server.ts:1883">
P1: Sensitive GitHub PAT is transmitted via URL query parameter on GET /hub/skills, risking exposure in access logs, browser history, and intermediary caches.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| } | ||
|
|
||
| const listing = await fetchJson(`${hubApiBase(repo)}/contents/skills?ref=${encodeURIComponent(repo.ref)}`); | ||
| const listing = await fetchJson(`${hubApiBase(repo)}/contents/skills?ref=${encodeURIComponent(repo.ref)}`, repo.token); |
There was a problem hiding this comment.
P1: Catalog cache key omits authentication context, so private repo listings fetched with a PAT can be served to later unauthenticated requests for the same owner/repo/ref.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/server/src/skill-hub.ts, line 113:
<comment>Catalog cache key omits authentication context, so private repo listings fetched with a PAT can be served to later unauthenticated requests for the same owner/repo/ref.</comment>
<file context>
@@ -108,7 +110,7 @@ export async function listHubSkills(repo: HubRepo = DEFAULT_HUB_REPO): Promise<H
}
- const listing = await fetchJson(`${hubApiBase(repo)}/contents/skills?ref=${encodeURIComponent(repo.ref)}`);
+ const listing = await fetchJson(`${hubApiBase(repo)}/contents/skills?ref=${encodeURIComponent(repo.ref)}`, repo.token);
const dirs = Array.isArray(listing)
? listing
</file context>
| const owner = ctx.url.searchParams.get("owner")?.trim(); | ||
| const repo = ctx.url.searchParams.get("repo")?.trim(); | ||
| const ref = ctx.url.searchParams.get("ref")?.trim(); | ||
| const token = ctx.url.searchParams.get("token")?.trim(); |
There was a problem hiding this comment.
P1: Sensitive GitHub PAT is transmitted via URL query parameter on GET /hub/skills, risking exposure in access logs, browser history, and intermediary caches.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/server/src/server.ts, line 1883:
<comment>Sensitive GitHub PAT is transmitted via URL query parameter on GET /hub/skills, risking exposure in access logs, browser history, and intermediary caches.</comment>
<file context>
@@ -1880,10 +1880,12 @@ function createRoutes(
const owner = ctx.url.searchParams.get("owner")?.trim();
const repo = ctx.url.searchParams.get("repo")?.trim();
const ref = ctx.url.searchParams.get("ref")?.trim();
+ const token = ctx.url.searchParams.get("token")?.trim();
const items = await listHubSkills({
owner: owner || "different-ai",
</file context>
|
Hey @SongotenU, I have submitted the PR to fix Issue #2295. This introduces a secure PAT-based authentication flow from the UI state all the way to the GitHub fetch API, completely resolving the 404 errors for internal and private repositories. The code is tested and architected to align with the core primitives. Looking forward to your review and feedback! Let me know if any changes are required |
1 participant
Summary
Added support for fetching Agent Skills from private and internal GitHub repositories by introducing a Personal Access Token (PAT) authentication flow.
Why
Currently, the application fails with a
Failed to fetch hub catalog (404)error when users attempt to add agent skills from private or internal repos because the backend lacks authentication credentials to fetch from the GitHub API. This feature directly supports the core alignment vision to enable FDE/Enterprise users to securely utilize private skills.Issue
Scope
Personal Access Token (Optional)field in the "Add git repo" modal UI (skills-view.tsx).HubSkillRepoand backend payload types to securely carry the token.fetchJsonandfetchTextutility functions inskill-hub.tsto attach theAuthorization: Bearer <TOKEN>header.Out of scope
Testing
Ran
Result
CI status
Manual verification
reposcope.Evidence
Risk
Rollback
extensions-store.tsandskill-hub.ts.