# NousResearch/hermes-agent · Fix path traversal false positives in Markdown links

## Open now

- Nothing open on GitHub.

A bug where the skills security scanner incorrectly flagged relative \`../\` links in Markdown documentation as path traversal attempts, blocking community skill installs. These members address identifying and ignoring legitimate Markdown doc links during path traversal checks.

## TL;DR

- 4 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 2 PR(s) closed without merging.
- A fix was merged to main in PR #111254. Verify it addresses your case.
- **Recommended:** read PR #111254 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-111254`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.50`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #110974: \[Bug\]: skills_guard path_traversal matches markdown doc links — a 3-level ../ link in a README blocks community skill installs

## Prior & competing PRs

- **#111254: Skills scanner no longer blocks installs over relative Markdown doc links (#110974; salvage #110989, #110978)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `tests/tools/test_skills_guard.py`, `tools/skills_guard.py`
- **#110978: fix(skills): ignore Markdown documentation traversal links**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `1a990f30628c`, `#111254`
- **#110989: fix(skills): ignore path traversal in Markdown link destinations**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `1a990f30628c`, `#111254`

## Fix status

- Merged to main in PR #111254 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-09-14`.