#23183: fix(skill-creator): exclude .git and VCS internals from .skill archives
size: XS
trusted-contributor
Cluster:
Skill Enhancements and Fixes
## Problem
`package_skill.py` includes `.git/` internals (and other VCS/build artifacts) in `.skill` archives. This causes:
- Unnecessary archive bloat
- Git history and metadata leakage in distributable skill packages
- Poor artifact hygiene
## Fix
Add an exclusion set checked during the `rglob` walk that skips:
- `.git`, `.svn`, `.hg` (VCS directories)
- `__pycache__` (Python bytecode cache)
- `node_modules` (JS dependencies)
- `.DS_Store` (macOS metadata)
The check uses path parts matching so nested occurrences are also excluded (e.g. `subdir/.git/objects`).
## Changes
- `skills/skill-creator/scripts/package_skill.py`: Add `EXCLUDED_DIRS` set and skip matching paths
Fixes #23149
<!-- greptile_comment -->
<h3>Greptile Summary</h3>
Adds VCS and build artifact exclusion to skill packaging to prevent `.git/` internals, `__pycache__`, `node_modules`, and other unwanted files from being included in `.skill` archives. The implementation uses path part matching to filter out any file or directory containing excluded names in its path.
<h3>Confidence Score: 5/5</h3>
- This PR is safe to merge with minimal risk
- The change is a focused security and hygiene improvement with clear logic. The exclusion set covers the most common VCS and build artifacts, and the path-matching approach correctly handles nested directories. The existing security checks (symlink validation) remain intact.
- No files require special attention
<sub>Last reviewed commit: 58ebee9</sub>
<!-- greptile_other_comments_section -->
<!-- /greptile_comment -->
Most Similar PRs
#23180: fix(skill-creator): exclude .git and VCS internals from .skill arch...
by SidQin-cyber · 2026-02-22
84.7%
#12076: fix(skills): recursive directory filtering to actually exclude venv...
by xiaoyaner0201 · 2026-02-08
79.8%
#10016: fix: prevent FD exhaustion from skill watcher scanning artifact trees
by oldeucryptoboi · 2026-02-06
79.6%
#8075: fix(skills): add --ignore-scripts to all package managers
by yubrew · 2026-02-03
79.0%
#6777: fix(skills): ignore Python venvs and caches in skills watcher
by kirkluokun · 2026-02-02
77.5%
#20796: fix(security): OC-22 prevent Zip Slip and symlink following in skil...
by aether-ai-agent · 2026-02-19
76.7%
#8291: Fix: Add Python virtual environment ignore patterns to skills watcher
by vishaltandale00 · 2026-02-03
76.4%
#9925: docs: warn about Python venv placement in skill directories
by kj9kj9qv4m-bit · 2026-02-05
76.3%
#23371: chore: add agentlint/prguard/secretmap skills + gitignore restart.sh
by alexmelges · 2026-02-22
75.4%
#19664: fix(skills): log skill YAML parsing diagnostics with skill name
by orchidsun · 2026-02-18
74.6%