Function handleSkillFile

server/routes/skills/[...pkg].get.ts:107–150

(
  event: H3Event,
  packageName: string,
  version: string,
  skillName: string,
  filePath: string,
)

}

async function handleSkillFile(
  event: H3Event,
  packageName: string,
  version: string,
  skillName: string,
  filePath: string,
): Promise<string> {
  // Validate file path to prevent directory traversal
  if (filePath.includes('..') || filePath.startsWith('/')) {
    throw createError({ statusCode: 400, message: 'Invalid file path' })
  }

  // Only allow files within skill subdirectories (scripts/, references/, assets/)
  const allowedPrefixes = ['scripts/', 'references/', 'assets/', 'refs/']
  if (!allowedPrefixes.some(p => filePath.startsWith(p))) {
    throw createError({
      statusCode: 400,
      message: 'File must be in scripts/, references/, or assets/ subdirectory',
    })
  }

  try {
    const content = await fetchSkillFile(packageName, version, `skills/${skillName}/${filePath}`)

    const ext = filePath.split('.').pop()?.toLowerCase() || ''
    const contentTypes: Record<string, string> = {
      md: 'text/markdown',
      txt: 'text/plain',
      json: 'application/json',
      js: 'text/javascript',
      ts: 'text/typescript',
      sh: 'text/x-shellscript',
      py: 'text/x-python',
    }
    setHeader(event, 'Content-Type', contentTypes[ext] || 'text/plain')

    return content
  } catch (error) {
    if (error && typeof error === 'object' && 'statusCode' in error && error.statusCode === 404) {
      throw createError({ statusCode: 404, message: ERROR_SKILL_FILE_NOT_FOUND })
    }
    throw error
  }
}