[rdimitrov]

Summary

• Why: OSS-Fuzz (FuzzParseSkillMD, testcase 4870994700075008) found that a crafted SKILL.md panics ParseSkillMD with runtime error: hash of unhashable type map[string]interface {}. The panic comes from gopkg.in/yaml.v3 v3.0.1: when a mapping has a << merge key, the decoder records every sibling key in a Go map, and a mapping-valued key (? {a: b}) cannot be a map key. gopkg.in/yaml.v3 is unmaintained, so the fix will not land there. Skill content comes from git repositories and OCI artifacts, so a malicious skill could crash thv skill install.
• What: pkg/skills now decodes frontmatter with go.yaml.in/yaml/v3 v3.0.5, the maintained fork with the same API, which returns an error for this input. It was already in go.mod as an indirect dependency and is now direct.
• parser.go, types.go (the StringOrSlice unmarshaler) and parser_test.go switch together: a custom UnmarshalYAML(*yaml.Node) only fires when the decoder comes from the same library, otherwise allowed-tools: Read Glob silently stops being split.
• Adds the crash input as a TestParseSkillMD case expecting invalid frontmatter.

Type of change

• Bug fix

Test plan

• Unit tests (go test ./pkg/skills/...)
• Manual testing (describe below)

Reproduced the panic with the crash input on main (same stack as OSS-Fuzz); after the change it returns invalid frontmatter. Ran go test ./pkg/skills -fuzz '^FuzzParseSkillMD$' -fuzztime 60s (~2.4M execs, no crash) and go vet ./pkg/skills/.

Does this introduce a user-facing change?

Before: a SKILL.md whose frontmatter combines a << merge key with a mapping-valued key crashed the process. After: it is rejected with invalid frontmatter. Valid skills parse as before.

Special notes for reviewers

Other packages still import gopkg.in/yaml.v3; moving them to the fork is a separate PR so this fix stays small.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.80%. Comparing base (9abf364) to head (3c524a8).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6919      +/-   ##
==========================================
- Coverage   79.83%   79.80%   -0.04%     
==========================================
  Files         827      828       +1     
  Lines       84553    84632      +79     
==========================================
+ Hits        67506    67543      +37     
- Misses      17042    17084      +42     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.