[Winoren]

Related issue

Fixes #8168.

Summary

A non-UTF-8 .crewai_meta.json currently raises UnicodeDecodeError before JSON parsing, aborting both SDK and CLI cached-skill listings. Catch it alongside the existing malformed-JSON handling so one corrupt entry does not hide healthy installed skills.

The fix adds the exception to the two existing handlers. Regression tests exercise actual temporary cache files through SkillCacheManager.list_cached and SkillCommand.list_cached, including an invalid-JSON control. They verify that the healthy entry remains visible and the corrupt file is left unchanged.

Verification

• Tests added for the changed behavior.
• Relevant tests and source quality checks pass locally.

On Python 3.13.12 / macOS arm64 with repository-lockfile dependencies:

# With new tests and production unchanged: 2 failed, 6 passed.
uv run --frozen --package crewai pytest lib/crewai/tests/skills/test_cache.py lib/cli/tests/skills/test_main.py -k list_cached -q

# After fix: 43 passed, 1 existing tarfile deprecation warning.
uv run --frozen --package crewai pytest lib/crewai/tests/skills/test_cache.py lib/cli/tests/skills/test_main.py -q

# Passed for both changed source files.
uv run --frozen --package crewai ruff check lib/crewai/src/crewai/skills/cache.py lib/cli/src/crewai_cli/skills/main.py
uv run --frozen --package crewai ruff format --check lib/crewai/src/crewai/skills/cache.py lib/cli/src/crewai_cli/skills/main.py
uv run --frozen --package crewai mypy lib/crewai/src/crewai/skills/cache.py lib/cli/src/crewai_cli/skills/main.py

git diff --check

Tests ran with CREWAI_TELEMETRY_DISABLED=true and OTEL_SDK_DISABLED=true. No model/provider calls or registry requests. Full monorepo tests were not run. Test files follow their existing style and are excluded by the repository's Ruff configuration.

Additional context

AI assistance: Codex investigated the code, prepared the fix and regression tests, and ran the checks above.

---

Note

Low Risk
Narrow defensive change to local cache enumeration only; no auth, network, or data-mutation behavior beyond skipping unreadable metadata files.

Overview
Fixes cached-skill listing when a global cache entry has a corrupt .crewai_meta.json (non-UTF-8 bytes or invalid JSON). Previously read_text(encoding="utf-8") could raise UnicodeDecodeError before JSON parsing and abort the whole listing, hiding healthy skills.

SkillCacheManager.list_cached (SDK) and SkillCommand.list_cached (CLI) now catch UnicodeDecodeError with the existing malformed-metadata handling—skip the bad entry (CLI warns; SDK logs at debug) and continue. Corrupt files are left on disk unchanged.

Regression tests cover both paths with parametrized bad metadata (invalid UTF-8 and invalid JSON) alongside a healthy cache entry.

^{Reviewed by Cursor Bugbot for commit b5b0172. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[strix-security]

Strix Security Review

Warning

This pull request has 54 commits after the last Strix review (d7ef754). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

Review summary

Reviewed all four changed files. The production change is limited to adding UnicodeDecodeError to two existing exception handlers in SkillCacheManager.list_cached and SkillCommand.list_cached, so non-UTF-8 cached skill metadata is skipped rather than aborting the listing. The data parsed is local, tool-generated cache metadata via json.loads (a safe parser), with no attacker-controlled input, no injection sink, and no auth/access-control or secret-handling changes. The remaining changes are regression tests. No security vulnerabilities were introduced or exposed by this PR.

_{Updated for d7ef754.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a5cf2b23-295c-4543-827e-12eb8c7bf5ec

📥 Commits

Reviewing files that changed from the base of the PR and between d7ef754 and 5dd6e13.

📒 Files selected for processing: 4

• lib/cli/src/crewai_cli/skills/main.py
• lib/cli/tests/skills/test_main.py
• lib/crewai/src/crewai/skills/cache.py
• lib/crewai/tests/skills/test_cache.py

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 18cf5e88-1649-458f-9cec-c5468424432c

📥 Commits

Reviewing files that changed from the base of the PR and between aa5f2ac and d7ef754.

📒 Files selected for processing: 4

• lib/cli/src/crewai_cli/skills/main.py
• lib/cli/tests/skills/test_main.py
• lib/crewai/src/crewai/skills/cache.py
• lib/crewai/tests/skills/test_cache.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The SDK and CLI cached-skill listing paths now skip metadata files that contain invalid UTF-8. Regression tests cover invalid UTF-8 and malformed JSON, and verify that healthy entries remain listed and malformed metadata is unchanged.

Changes: Cached skill listing

Layer / File(s)	Summary
Skip unreadable cache metadata lib/crewai/src/crewai/skills/cache.py, lib/crewai/tests/skills/test_cache.py, lib/cli/src/crewai_cli/skills/main.py, lib/cli/tests/skills/test_main.py	The SDK and CLI listing paths catch UnicodeDecodeError and skip the affected entry. Tests cover invalid UTF-8 and malformed JSON, confirm that healthy entries are listed, and verify that malformed metadata bytes remain unchanged.

Suggested reviewers: joaomdmoura

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to d7ef7

Cached-skill listings can continue past unreadable metadata without changing the corrupt file. No issue identified here needs to block merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title "fix(skills): skip non-UTF-8 cached skill metadata" states the main change. The PR makes the SDK and CLI cached-skill listings skip a .crewai_meta.json file that raises UnicodeDecodeError, s…
Description check		The description follows the template. It links issue #8168 with "Fixes #8168." It has a Summary that explains the cause and the fix. It has a Verification section with the test and quality check resul…
Linked Issues check		[#8168] requires that SkillCacheManager.list_cached() and the crewai skills list CLI skip a cache entry whose .crewai_meta.json cannot be decoded, continue listing healthy skills, and leave the corrup…
Out of Scope Changes check		The whole-PR diff against the merge base touches four files: the two production handlers, and the SDK and CLI test files. The production changes are one-line exception-tuple edits in the two listing p…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Vidit-Ostwal]

lgtm

[github-actions]

Thanks for your first contribution to CrewAI, @Winoren!

We really appreciate the time and care you put into this PR. Your work is now part of CrewAI — welcome to the contributor community.

Want to share your contribution? Totally optional:

Share on X · Share the PR on LinkedIn

If the links don't work, feel free to copy and personalize this:

I just made my first contribution to @crewAIInc!

Excited to help build the future of AI agents with CrewAI.

https://github.com/crewAIInc/crewAI/pull/8169

#OpenSource #AI #CrewAI

If you share, we'd love to see it — tag @crewAIInc on X and CrewAI on LinkedIn.