From efb90cebb7a59e8bdc0cdcc616bc7b73ced125e9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 01:33:01 +0000 Subject: [PATCH 1/3] chore(deps): update atlassian/forge-skills digest to ccef03b --- skills/forge-app-builder/spec.yaml | 2 +- skills/forge-app-review/spec.yaml | 2 +- skills/forge-debugger/spec.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/skills/forge-app-builder/spec.yaml b/skills/forge-app-builder/spec.yaml index 7433e30c..a84d085d 100644 --- a/skills/forge-app-builder/spec.yaml +++ b/skills/forge-app-builder/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/atlassian/forge-skills" - ref: "1b89cbd61844471264a7d4dce8eed44402f7f77f" # main as of 2026-04-19 + ref: "ccef03b209ae0c4235ba80c22546010ed81a04dd" # main as of 2026-04-19 path: "skills/forge-app-builder" version: "0.3.2" diff --git a/skills/forge-app-review/spec.yaml b/skills/forge-app-review/spec.yaml index 11851c07..982b6c6b 100644 --- a/skills/forge-app-review/spec.yaml +++ b/skills/forge-app-review/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/atlassian/forge-skills" - ref: "1b89cbd61844471264a7d4dce8eed44402f7f77f" # main as of 2026-04-19 + ref: "ccef03b209ae0c4235ba80c22546010ed81a04dd" # main as of 2026-04-19 path: "skills/forge-app-review" version: "0.3.1" diff --git a/skills/forge-debugger/spec.yaml b/skills/forge-debugger/spec.yaml index c633ff9e..4609596b 100644 --- a/skills/forge-debugger/spec.yaml +++ b/skills/forge-debugger/spec.yaml @@ -9,7 +9,7 @@ metadata: spec: repository: "https://github.com/atlassian/forge-skills" - ref: "1b89cbd61844471264a7d4dce8eed44402f7f77f" # main as of 2026-04-19 + ref: "ccef03b209ae0c4235ba80c22546010ed81a04dd" # main as of 2026-04-19 path: "skills/forge-debugger" version: "0.2.3" From 2213a394aec4347552c675e5098bb23d0070b8fb Mon Sep 17 00:00:00 2001 From: "toolhive-release-app[bot]" <280093410+toolhive-release-app[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 01:33:40 +0000 Subject: [PATCH 2/3] chore(skills): bump spec.version for forge-app-builder,forge-app-review,forge-debugger --- skills/forge-app-builder/spec.yaml | 2 +- skills/forge-app-review/spec.yaml | 2 +- skills/forge-debugger/spec.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/skills/forge-app-builder/spec.yaml b/skills/forge-app-builder/spec.yaml index a84d085d..be295372 100644 --- a/skills/forge-app-builder/spec.yaml +++ b/skills/forge-app-builder/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/atlassian/forge-skills" ref: "ccef03b209ae0c4235ba80c22546010ed81a04dd" # main as of 2026-04-19 path: "skills/forge-app-builder" - version: "0.3.2" + version: "0.4.0" provenance: repository_uri: "https://github.com/atlassian/forge-skills" diff --git a/skills/forge-app-review/spec.yaml b/skills/forge-app-review/spec.yaml index 982b6c6b..03fbf309 100644 --- a/skills/forge-app-review/spec.yaml +++ b/skills/forge-app-review/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/atlassian/forge-skills" ref: "ccef03b209ae0c4235ba80c22546010ed81a04dd" # main as of 2026-04-19 path: "skills/forge-app-review" - version: "0.3.1" + version: "0.4.0" provenance: repository_uri: "https://github.com/atlassian/forge-skills" diff --git a/skills/forge-debugger/spec.yaml b/skills/forge-debugger/spec.yaml index 4609596b..0c23af2e 100644 --- a/skills/forge-debugger/spec.yaml +++ b/skills/forge-debugger/spec.yaml @@ -11,7 +11,7 @@ spec: repository: "https://github.com/atlassian/forge-skills" ref: "ccef03b209ae0c4235ba80c22546010ed81a04dd" # main as of 2026-04-19 path: "skills/forge-debugger" - version: "0.2.3" + version: "0.3.0" provenance: repository_uri: "https://github.com/atlassian/forge-skills" From 987d983415d39676bffbd97c6171f6c03dbcd05a Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Mon, 26 Oct 2026 22:18:36 -0400 Subject: [PATCH 3/3] Allowlist LLM_COMMAND_INJECTION for forge-app-builder The LLM analyzer now reports the shell=True call at scripts/deploy_forge_app.py:68 under LLM_COMMAND_INJECTION. The script is unchanged from the previously reviewed ref, and the deterministic COMMAND_INJECTION_SHELL_TRUE finding for the same call is already allowlisted, so reuse that reasoning. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: Dan Barr <6922515+danbarr@users.noreply.github.com> --- skills/forge-app-builder/spec.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/skills/forge-app-builder/spec.yaml b/skills/forge-app-builder/spec.yaml index be295372..e298b297 100644 --- a/skills/forge-app-builder/spec.yaml +++ b/skills/forge-app-builder/spec.yaml @@ -27,3 +27,5 @@ security: # longer filters them (see #1047). - rule_id: COMMAND_INJECTION_SHELL_TRUE reason: "Accepted risk: scripts/deploy_forge_app.py:68 runs `forge` CLI commands with shell=True, interpolating the operator's own --site, --env, and --developer-space-id arguments. Input comes from the person running the script locally, not from untrusted content." + - rule_id: LLM_COMMAND_INJECTION + reason: "Accepted risk: LLM-analyzer duplicate of COMMAND_INJECTION_SHELL_TRUE above. scripts/deploy_forge_app.py:68 runs `forge` CLI commands with shell=True, interpolating the operator's own --site, --env, and --developer-space-id arguments. Input comes from the person running the script locally, not from untrusted content."