fix: restrict remote skill sources to GitHub

[failsafesecurity]

Summary

This restricts remote skill imports to GitHub shorthand or canonical GitHub HTTPS URLs before the backend invokes the skills CLI.

Security impact

Before this patch, any authenticated user could call the remote-skill import endpoints with an arbitrary source value. The backend passed that value straight into npx skills add <source>, which let a regular user trigger server-side clone/fetch requests to localhost, RFC1918 addresses, cloud metadata endpoints, or other internal HTTP(S) services reachable from the Yuxi host.

Changes

• validate source before invoking the remote skills CLI
• allow only OWNER/REPO shorthand or canonical https://github.com/OWNER/REPO(.git) URLs
• reject localhost, non-GitHub hosts, file://, SSH, and query-string variants
• add regression coverage for accepted and rejected source formats

Validation

• reproduced the issue non-destructively with npx -y skills add http://127.0.0.1:9/repo.git --list, which attempted a backend-side clone to loopback
• added unit coverage for source normalization
• syntax-checked the touched Python files with python3 -m py_compile
• full pytest execution was not possible in this host environment because pytest/uv are not installed here

Disclosure notes

• finding id: FIND-001
• pool: security-impact
• GitHub private vulnerability reporting is disabled for this repo
• no SECURITY.md is present in the repo root
• nothing has been submitted publicly

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[xerrors]

Thank you for pointing out this issue. However, the Skills we support are not limited to GitHub repositories. For example, ModelScope Skills can use URLs such as https://modelscope.cn/skills/@pskoett/self-improving-agent.

Therefore, restricting the source validation to GitHub repositories only would reject valid Skill sources. Could we broaden the validation to support other legitimate Skill formats while still preventing requests to localhost, private networks, and other internal endpoints?