I noticed commands/clone.go:546 does filepath.Join(localPath, item.Name) using the GitHub API JSON item.Name with no traversal check. Low risk today since the source repo is hardcoded and trusted over HTTPS, but worth adding defense-in-depth in case that repo or the API response is ever compromised.
I'd reject item.Name containing /, .., or absolute-path prefixes before joining.
I noticed
commands/clone.go:546doesfilepath.Join(localPath, item.Name)using the GitHub API JSONitem.Namewith no traversal check. Low risk today since the source repo is hardcoded and trusted over HTTPS, but worth adding defense-in-depth in case that repo or the API response is ever compromised.I'd reject
item.Namecontaining/,.., or absolute-path prefixes before joining.