Reject special skill archive members

lib/cli/src/crewai_cli/experimental/skills/main.py

@@ -393,6 +393,8 @@ def _safe_extractall(tf: tarfile.TarFile, dest: Path) -> None:
         member_path = (dest / member.name).resolve()
         if not member_path.is_relative_to(dest_resolved):
             raise ValueError(f"Blocked path traversal attempt: {member.name!r}")
+        if not (member.isfile() or member.isdir() or member.issym() or member.islnk()):
+            raise ValueError(f"Blocked unsupported tar member: {member.name!r}")
         if member.issym() or member.islnk():
             link_target = member.linkname
             # Absolute link targets always escape the destination.

lib/cli/tests/skills/test_safe_extract.py

@@ -83,6 +83,21 @@ def test_blocks_hardlink_escaping_destination(tmp_path: Path) -> None:
             _safe_extractall(tf, dest)
 
 
+def test_blocks_special_tar_member(tmp_path: Path) -> None:
+    """Special tar members such as FIFOs are rejected."""
+    dest = tmp_path / "dest"
+    dest.mkdir()
+
+    def build(tf: tarfile.TarFile) -> None:
+        fifo = tarfile.TarInfo("pipe")
+        fifo.type = tarfile.FIFOTYPE
+        tf.addfile(fifo)
+
+    with _tar_from_members(build) as tf:
+        with pytest.raises(ValueError, match="unsupported tar member"):
+            _safe_extractall(tf, dest)
+
+
 def test_allows_benign_relative_symlink(tmp_path: Path) -> None:
     """A symlink that stays within dest is permitted."""
     dest = tmp_path / "dest"

lib/crewai/src/crewai/experimental/skills/cache.py

@@ -142,6 +142,8 @@ def _safe_extractall(tf: tarfile.TarFile, dest: Path) -> None:
         member_path = (dest / member.name).resolve()
         if not member_path.is_relative_to(dest_resolved):
             raise ValueError(f"Blocked path traversal attempt: {member.name!r}")
+        if not (member.isfile() or member.isdir() or member.issym() or member.islnk()):
+            raise ValueError(f"Blocked unsupported tar member: {member.name!r}")
         if member.issym() or member.islnk():
             link_target = member.linkname
             if os.path.isabs(link_target):

lib/crewai/tests/experimental/skills/test_cache.py

@@ -170,6 +170,21 @@ def test_safe_extractall_blocks_hardlink_escaping_cache_destination(
             _safe_extractall(tf, dest)
 
 
+def test_safe_extractall_blocks_special_cache_tar_member(tmp_path: Path) -> None:
+    """Special tar members such as FIFOs are rejected."""
+    dest = tmp_path / "dest"
+    dest.mkdir()
+
+    def build(tf: tarfile.TarFile) -> None:
+        fifo = tarfile.TarInfo("pipe")
+        fifo.type = tarfile.FIFOTYPE
+        tf.addfile(fifo)
+
+    with _tar_from_members(build) as tf:
+        with pytest.raises(ValueError, match="unsupported tar member"):
+            _safe_extractall(tf, dest)
+
+
 def test_safe_extractall_allows_benign_cache_symlink(tmp_path: Path) -> None:
     """A symlink that stays within dest is permitted."""
     dest = tmp_path / "dest"