[Bug] `update_scheduled_task` fails with path traversal error when updating prompt or description

Resolved 💬 2 comments Opened May 5, 2026 by chien7pro-wq Closed Jun 22, 2026

Bug Description
Bug: update_scheduled_task always fails when updating prompt or description
Calling mcp__scheduled-tasks__update_scheduled_task with either the
prompt or description field always returns:
Failed to update scheduled task: Invalid file path: path traversal detected
The same call succeeds when only enabled or cronExpression is changed.
Even a minimal ASCII payload (e.g. prompt = "test") fails, so it's not
a character/length issue — looks like the path-validation step that
runs when the tool tries to rewrite SKILL.md is broken.
Repro:

  1. Call mcp__scheduled-tasks__update_scheduled_task
  2. taskId = any existing task
  3. Pass prompt OR description (any value)
  4. → "path traversal detected"
  5. Pass enabled: true instead → succeeds

Workaround:
Use Write directly on
~/Documents/Claude/Scheduled/{taskId}/SKILL.md
to bypass the tool. The frontmatter description: field is what
list_scheduled_tasks reads from, so editing the file is sufficient.
Impact:
Users can't update a scheduled task's instructions via the tool.
The schedule UI's "Save" likely hits the same code path and is also broken.

Environment Info

  • Platform: darwin
  • Terminal: ghostty
  • Version: 2.1.128
  • Feedback ID: 936fa949-32f7-41ab-a091-f4f0b2494644

Errors

[{"error":"Error: NON-FATAL: Lock acquisition failed for /Users/chien7/.local/share/claude/versions/2.1.128 (expected in multi-process scenarios)\n    at Nq6 (/$bunfs/root/src/entrypoints/cli.js:2764:2177)\n    at uGH (/$bunfs/root/src/entrypoints/cli.js:2764:1257)\n    at processTicksAndRejections (native:7:39)","timestamp":"2026-05-05T08:58:10.783Z"}]

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗