From fd45d86ce5086d3874692eb28dbfcd22caaada27 Mon Sep 17 00:00:00 2001
From: Jinwoo-H <jinwoo0825@gmail.com>
Date: Wed, 12 Aug 2026 10:52:09 -0400
Subject: [PATCH] fix(skills): reject Windows device names

---
 src/shared/skill-package-manifest.test.ts | 9 +++++++++
 src/shared/skill-package-manifest.ts      | 3 ++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/shared/skill-package-manifest.test.ts b/src/shared/skill-package-manifest.test.ts
index 5e1a124025b..210737ac561 100644
--- a/src/shared/skill-package-manifest.test.ts
+++ b/src/shared/skill-package-manifest.test.ts
@@ -37,6 +37,15 @@ describe('skill package manifest', () => {
     expect(parseSkillPackageManifest(manifest()).name).toBe('test-skill')
   })
 
+  it.each(['con', 'prn', 'aux', 'nul', 'com1', 'com9', 'lpt1', 'lpt9'])(
+    'rejects the Windows device skill name %s',
+    (name) => {
+      expect(() => parseSkillPackageManifest({ ...(manifest() as object), name })).toThrow(
+        'skill-package-skill-name-invalid'
+      )
+    }
+  )
+
   it.each([
     '../SKILL.md',
     '/SKILL.md',
diff --git a/src/shared/skill-package-manifest.ts b/src/shared/skill-package-manifest.ts
index bd192387608..668bcb0cd2e 100644
--- a/src/shared/skill-package-manifest.ts
+++ b/src/shared/skill-package-manifest.ts
@@ -44,7 +44,7 @@ export const SkillPackageManifestV1Schema = z
 export type SkillPackageManifestV1 = z.infer<typeof SkillPackageManifestV1Schema>
 
 export function validateSkillPackageName(name: string): void {
-  if (!SKILL_NAME_PATTERN.test(name)) {
+  if (!SKILL_NAME_PATTERN.test(name) || WINDOWS_RESERVED_SEGMENT.test(name)) {
     throw new Error('skill-package-skill-name-invalid')
   }
 }
@@ -96,6 +96,7 @@ export function parseSkillPackageManifest(value: unknown): SkillPackageManifestV
   if (!parsed.success) {
     throw new Error('skill-package-manifest-invalid')
   }
+  validateSkillPackageName(parsed.data.name)
   let previousPath: string | null = null
   const foldedPaths = new Set<string>()
   let totalBytes = 0