skilldrop 1.0.1
Released 2026-10-21 · npx skilldrop-cli@1.0.1
file-to-markdown's Office and Outlook readers are now fuzzed, and 16 bugs are fixed. The fuzzer found 10. Reading the parser around them found 6 more, all hangs or memory blow-ups, which a time-limited fuzzer rarely reaches. The .msg reader is a hand-written binary parser, so it now has a valid Outlook message to start from. Each Office format is fuzzed twice: as a whole file, and with only its XML part changing inside a valid package, so the mutations get past the zip checksum. - Small files could hang it or fill memory. A 2.5 KB .msg whose sector chain looped back on itself took 657 MB before it failed; it now stops at the first repeated sector. A spreadsheet with one value atZZZ999999built a grid of a million empty rows, and now keeps only the rows and columns that hold a value. A .msg that listed one FAT sector many times, a Word table cell spanning a billion columns, an HTMLcolspanthe same size, or a list nested 99 million levels deep are now capped at what each format allows. - Damaged files now fail with a one-line message, not a traceback. That covers a corrupt or truncated .docx, .pptx, .xlsx, .msg or .eml, a package with a part marked as encrypted, a Word file with no body, and a cell reference that isn't one, which is now skipped. A password-protected Office file is now named as one, with the fix: remove the password and rerun. - Emails read on more inputs. An unknown charset is read as UTF-8, as the HTML reader already did. A raw UTF-8 header keeps its text. A sent time past the year 9999 is left out. On Python 3.9, a date or MIME boundary that won't parse no longer stops the conversion. - The fuzzer also runs the converters both ways. Markdown goes to .docx, .xlsx or .pptx and back throughfile-to-markdown, so every file one writes must be one the other reads.md-to-confluenceis fuzzed too. All 28 targets then ran 4,000 mutated inputs on Python 3.9 and 3.14 without a crash, and in CI an input that takes over 10 seconds now counts as one (RFC-0062).- Four smaller fixes: -
delivery-metrics-reportandteam-status-report --plan-filenow fail with a one-line message on a file that isn't UTF-8, where they used to show a traceback. -rollout-planrejects--max-hours nanorinf, which used to print "within nan h". -hypothesis-comparisongives an error's real line number after a blank line, and rejects a weight ofnanorinf.