Windows npx ctx7 setup fails: "Skill file path SKILL.md resolves outside the target directory"?

5 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Fixed. The maintainers released the fix on 2026-04-14 ("we've just released the fix for this") and closed the issue as completed on 2026-06-03. Update ctx7 and run npx ctx7 setup again.

  Root cause: a directory-traversal guard added in #2235 checks path prefixes with a hardcoded "/". On Windows, path.resolve() returns backslashes, so valid paths always trip the guard. A commenter located the source in packages/cli/src/utils/installer.ts and noted the merged fix (#2441) handles the backslash branch; on 2026-04-13 they reported npm still listed 0.3.12, so fresh setups kept failing until the release.

  Until you can update, two local patches were confirmed in the thread:

  1. In ctx7 0.3.9, patch dist/index.js (around line 728) to normalize path separators so Windows paths pass the guard; a commenter confirmed this resolved it.
  2. Replace filePath.startsWith(skillDir + "/") with !filePath.startsWith(skillDir + "/") && !filePath.startsWith(skillDir + "\\") && filePath !== skillDir; a commenter confirmed this solved the failure.

  A third suggestion — patching the cached package at ~/AppData/Local/npm-cache/_npx/<hash>/node_modules/ctx7/dist/index.js and swapping "/" for path.sep — was proposed but not confirmed. General advice: editing the installed package file is only a local workaround.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @Miraclexc tried on GitHub (Worked)

  A contributor suggested replacing the hardcoded '/' prefix check in node_modules/ctx7/dist/index.js with a version that also accepts backslashes and allows the exact skill directory: !filePath.startsWith(skillDir + "/") && !filePath.startsWith(skillDir + "\\") && filePath !== skillDir. A commenter later confirmed this solved the failure.

  Source: https://github.com/upstash/context7/issues/2361#issuecomment-4227937984 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @VictorVile tried on GitHub (Worked)

  A user reported failing on ctx7 0.3.9 and patched the installed CLI at C:/nvm4w/nodejs/node_modules/ctx7/dist/index.js:728 to normalize path separators; another commenter confirmed it resolved the issue.

  Source: https://github.com/upstash/context7/issues/2361#issuecomment-4184025941 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @josuebustosn tried on GitHub (Outcome unclear)

  A user traced the root cause to packages/cli/src/utils/installer.ts and proposed patching the cached package at ~/AppData/Local/npm-cache/_npx//node_modules/ctx7/dist/index.js, swapping the hardcoded "/" for path.sep in installSkillFiles. No one confirmed applying this exact patch.

  Source: https://github.com/upstash/context7/issues/2361#issuecomment-4239944512 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Ran npx ctx7 setup in PowerShell on Windows, selected 'CLI + Skills', authenticated, and chose OpenCode; the find-docs skill install failed with Skill file path "SKILL.md" resolves outside the target directory for C:\Users\17646.agents\skills\find-docs.

  Source: https://github.com/upstash/context7/issues/2361 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport