Skills Hub sandbox permissions and link handling
Cluster 91612 · apps/desktop. Data as of
Nothing open on GitHub. Fix merged in #128278 on 1 Oct 2026. Check it covers your case.
The short answer
- Known?
- Yes. 3 related items grouped here, 1 issue already closed.
- Fix event
- A fix was merged to main in PR #128278. Check it covers your case. No release data is tracked.
- Tracker
- The maintainers' tracker marks this
resolved, deciding PR #128278. That is separate from the fix event. - Still open
- Nothing open on GitHub.
These items address a bug where the embedded Skills Hub sandbox was blocking external links, clipboard access, and frame pinning. Two fixes attempt to restore those capabilities in the desktop environment.
Open issues0
Open PRs0
Fixes on record
-
#128278 fix(desktop): restore Skills Hub links, clipboard, and frame pinning
files:
apps/desktop/electron/hub-iframe-policy.ts,apps/desktop/electron/main.ts,apps/desktop/electron/window-open-policy.test.ts,apps/desktop/electron/window-open-policy.ts,apps/desktop/src/plugins/hermes-bots/skills-hub-picker.test.tsx,apps/desktop/src/plugins/hermes-bots/skills-hub.tsx
1 PR closed without merging
From the close comments: superseded by another PR 1
-
#97945 fix(desktop): allow Skills Hub links and clipboard writes · superseded by another PR →
2a400b4,#91612
Closed issues · 1
- Closed#91612[Bug]: embedded Skills Hub sandbox blocks its own external links and clipboard controls
How this cluster was grouped
-
Link evidence (
structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference. -
Pairwise link density
0.67: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36.1.00means every pair is linked.
Pick up a Lab task
Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.
Open the LabAt a glance
- Subsystem
- apps/desktop
- Merged PRs
- #128278
- Closed issues
- 1
- Attempts
- 1 PR closed without merging
- Fix link checked
- 1 Oct 2026