Repository navigation
gh skill search panics with a slice bounds error for very large --page or --limit values #14985
Description
Describe the bug
gh skill search crashes with a slice bounds panic when --page or --limit is given a very large value, because those values are multiplied together to compute slice offsets and the multiplication overflows.
The panic needs the search to return at least one result, so the query has to match something.
There are two separate places that can panic, depending on the values used.
Affected version
$ gh version
gh version 2.103.3-71-g736c68f67 (2026-11-07)
https://github.com/cli/cli/releases/latest
This is a build of trunk. The skill search command was added in v2.90.0 and every release since then, up to and including v2.103.3, is affected.
Steps to reproduce the behavior
-
Run a search that matches at least one skill, with a very large
--page:gh skill search terraform --page 9223372036854775807 --limit 2 -
View the output
-
See error
The same happens with a large --limit alone:
gh skill search terraform --limit 4000000000000000000
And with a --page and --limit combination that overflows a different calculation, which panics in a different place:
gh skill search terraform --page 2026277576509488133 --limit 7
Expected vs actual behavior
Expected: gh should report that the requested page or limit is out of range.
Actual: gh panics and exits with status 2.
Logs
For gh skill search terraform --page 9223372036854775807 --limit 2:
panic: runtime error: slice bounds out of range [:-6]
goroutine 1 [running]:
github.com/cli/cli/v2/pkg/cmd/skills/search.truncateForProcessing(...)
github.com/cli/cli/v2/pkg/cmd/skills/search/search.go:373
github.com/cli/cli/v2/pkg/cmd/skills/search.searchRun(0x2837e6b3ea20)
github.com/cli/cli/v2/pkg/cmd/skills/search/search.go:239 +0x60a
github.com/cli/cli/v2/pkg/cmd/skills/search.NewCmdSearch.func1(0x0?, {0x2837e6d90be0?, 0x0?, 0x0?})
github.com/cli/cli/v2/pkg/cmd/skills/search/search.go:131 +0x1d0
github.com/cli/cli/v2/pkg/cmdutil.RecordTelemetry.func2(0x2837e6bae308, {0x2837e6bae308, 0x1?, 0x5?})
github.com/cli/cli/v2/pkg/cmdutil/telemetry.go:40 +0x32
github.com/spf13/cobra.(*Command).execute(0x2837e6bae308, {0x2837e6b9b90, 0x5, 0x5})
github.com/spf13/cobra@v1.10.2/command.go:1015 +0xb3c
github.com/spf13/cobra.(*Command).ExecuteC(0x2837e6c0d808)
...
exit status 2
For gh skill search terraform --page 2026277576509488133 --limit 7:
panic: runtime error: slice bounds out of range [:-4262801038143134685]
goroutine 1 [running]:
github.com/cli/cli/v2/pkg/cmd/skills/search.paginate(...)
github.com/cli/cli/v2/pkg/cmd/skills/search/search.go:416
github.com/cli/cli/v2/pkg/cmd/skills/search.searchRun(0xd16ce0cc6c0)
github.com/cli/cli/v2/pkg/cmd/skills/search/search.go:258 +0x5fe
github.com/cli/cli/v2/pkg/cmd/skills/search.NewCmdSearch.func1(0x0?, {0xd16cd9371d0?, 0x0?, 0x0?})
github.com/cli/cli/v2/pkg/cmd/skills/search/search.go:131 +0x1d0
github.com/cli/cli/v2/pkg/cmdutil.RecordTelemetry.func2(0xd16ce25db08, {0xd16ce25db08, 0x1?, 0x5?})
github.com/cli/cli/v2/pkg/cmdutil/telemetry.go:40 +0x32
github.com/spf13/cobra.(*Command).execute(0xd16ce25db08, {0xd16cd936dc0, 0x5, 0x5})
github.com/spf13/cobra@v1.10.2/command.go:1015 +0xb3c
github.com/spf13/cobra.(*Command).ExecuteC(0xd16cde98008)
...
exit status 2
Activity
cli-triage commentedon Nov 7, 2026
Reproducible on 2.103.3.
Using test data with one matching skill:
Exit status:
2. Expected: a clear validation error, not a panic.The current source build has the same result. A very large
--limitand the reported alternate page/limit combination also panic. Normal-sized values avoid the failure, but the command should reject values that overflow its pagination calculations.Supporting reports
Duplicate analysis
Label reasoning
Reproduction log
Investigation notes
Generated by issue triage.
shounakjoshi88-a11y commentedon Nov 10, 2026
I'd like to take this one.
The overflow shows up in two places, both in pkg/cmd/skills/search/search.go: runcateForProcessing multiplies the page and limit to compute a slice offset, and paginate computes the start index the same way, so either can overflow int64 and produce a negative slice bound.
My plan is to validate --page and --limit before any slicing happens, so an out-of-range value returns a clear error instead of a panic, and to add regression tests covering the three reported cases (large --page, large --limit, and the --page/--limit pair that overflows the second calculation). The change should stay confined to pkg/cmd/skills/search.
AI tools were used to assist with the investigation and the initial patch; I reviewed and verified every line, and the tests are run locally.
shounakjoshi88-a11y commentedon Nov 10, 2026
Could you add the help wanted label to this issue?
The pull request that fixes it (#15007) is referenced by the PR triage bot, which requires the linked issue to carry that label before the PR will be reviewed. The bug is reproducible on runk and the fix is ready to review: the page and limit values are multiplied to compute slice bounds in three places, and the fix makes that arithmetic overflow-safe and rejects the overflowing combinations with a clear error instead of a panic.