[renovate]

This PR contains the following updates:

Package	Update	Change
getsentry/skills	digest	f57ada2 → d12f250

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ agents-md

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ claude-settings-audit

• Status: Passed
• Findings: 3
• Allowed (not blocking): 3
  • LLM_UNAUTHORIZED_TOOL_USE (Allowed: Accepted risk, real flaw in upstream guidance: the skill generates Claude Code permissions it describes as read-only commands that cannot modify state (SKILL.md:8, :294), but its baseline includes "Bash(gh api:)" (SKILL.md:92). As SKILL.md:297 notes, : allows any arguments, so this also permits write calls such as gh api -X DELETE. Not malicious; accepted because users review generated settings before applying them. Note this entry matches any LLM_UNAUTHORIZED_TOOL_USE finding for this skill.)
  • LLM_SKILL_DISCOVERY_ABUSE (Allowed: Accepted risk: the judge raised the same "Bash(gh api:*)" read-only mislabeling (SKILL.md:92) under this rule as well; see the LLM_UNAUTHORIZED_TOOL_USE entry. Note this entry matches any LLM_SKILL_DISCOVERY_ABUSE finding for this skill, including unrelated ones.)
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ code-review

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ code-simplifier

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ commit

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ create-branch

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ django-access-review

• Status: Passed
• Findings: 0

✅ django-perf-review

• Status: Passed
• Findings: 0

✅ doc-coauthoring

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ find-bugs

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ gh-review-requests

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ gha-security-review

• Status: Passed
• Findings: 8
• Allowed (not blocking): 7
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)
  • PIPELINE_TAINT_FLOW (Allowed: The skill's reference material cites curl | bash and similar RCE patterns as instructional examples of supply-chain-style attacks detectable in CI workflows. The scanner itself flags these as 'found in documentation file — may be instructional rather than executable'.)
  • PG_PII_CREDENTIAL_HARVESTING (Allowed: False positive - matches "extract credential" on
    references/credential-escalation.md, which is literally the topic of
    that reference file (how to spot credential-extraction attacks in
    GitHub Actions). Verified at digest
    5cfc9e22a91c2d3a230c4d5154ea0f1babce3b28.
    )
  • PIPELINE_TAINT_FLOW (Allowed: The skill's reference material cites curl | bash and similar RCE patterns as instructional examples of supply-chain-style attacks detectable in CI workflows. The scanner itself flags these as 'found in documentation file — may be instructional rather than executable'.)
  • PIPELINE_TAINT_FLOW (Allowed: The skill's reference material cites curl | bash and similar RCE patterns as instructional examples of supply-chain-style attacks detectable in CI workflows. The scanner itself flags these as 'found in documentation file — may be instructional rather than executable'.)
  • PIPELINE_TAINT_FLOW (Allowed: The skill's reference material cites curl | bash and similar RCE patterns as instructional examples of supply-chain-style attacks detectable in CI workflows. The scanner itself flags these as 'found in documentation file — may be instructional rather than executable'.)
  • YARA_SUSP_Multi_CredentialExfil_Chain_Sep26 (Allowed: FP: references/runner-infrastructure.md:42 is inside a fenced example labeled Attacker's code in a fork PR running on self-hosted runner, showing credential theft (cat ~/.npmrc, ~/.docker/config.json, ~/.aws/credentials) that the review skill teaches reviewers to detect.)

For review, not blocking: 1 MEDIUM finding(s)

• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/pwn-request.md at line 76 contains potentially dangerous Python code. (references/pwn-request.md:76)

✅ iterate-pr

• Status: Passed
• Findings: 5
• Allowed (not blocking): 4
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)
  • COMMAND_INJECTION_OS_SYSTEM (Allowed: FP: scripts/fetch_pr_feedback.py:167 and scripts/reply_to_thread.py:75 call subprocess.run with argument lists (gh api graphql -f query=...), no shell. The f-strings build a single argv element, and reply bodies are JSON-escaped with json.dumps before going into the query.)
  • RESOURCE_ABUSE_INFINITE_LOOP (Allowed: The scripts/monitor_pr_checks.py helper polls PR check status in a while True: loop with bounded retries and sleep — legitimate for waiting until CI reaches a terminal state. The script has a timeout and exit conditions.)
  • COMMAND_INJECTION_OS_SYSTEM (Allowed: FP: scripts/fetch_pr_feedback.py:167 and scripts/reply_to_thread.py:75 call subprocess.run with argument lists (gh api graphql -f query=...), no shell. The f-strings build a single argv element, and reply bodies are JSON-escaped with json.dumps before going into the query.)

For review, not blocking: 1 file(s) the LLM judge only partly read

The LLM judge exceeded its context budget on: scripts/fetch_pr_feedback.py. Review these files manually.

✅ pr-writer

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ prompt-optimizer

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

✅ security-review

• Status: Passed
• Findings: 13
• Allowed (not blocking): 4
  • ACTIVE_DYNAMIC_EXECUTION (Allowed: FP: SKILL.md:190 lists eval(user_input) as a vulnerable pattern the security review should flag. It's an example of what to detect, not an instruction to run.)
  • MDBLOCK_PYTHON_EVAL_EXEC (Allowed: FP: languages/python.md:215 and :262 and references/supply-chain.md:234 are vulnerable-code examples (eval(user_input), eval(data['expression']), exec(base64.b64decode(...))) that the review skill teaches reviewers to flag.)
  • MDBLOCK_PYTHON_EVAL_EXEC (Allowed: FP: languages/python.md:215 and :262 and references/supply-chain.md:234 are vulnerable-code examples (eval(user_input), eval(data['expression']), exec(base64.b64decode(...))) that the review skill teaches reviewers to flag.)
  • MDBLOCK_PYTHON_EVAL_EXEC (Allowed: FP: languages/python.md:215 and :262 and references/supply-chain.md:234 are vulnerable-code examples (eval(user_input), eval(data['expression']), exec(base64.b64decode(...))) that the review skill teaches reviewers to flag.)

For review, not blocking: 9 MEDIUM finding(s)

• [MDBLOCK_PYTHON_SUBPROCESS] Code block in languages/python.md at line 79 contains potentially dangerous Python code. (languages/python.md:79)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in languages/python.md at line 221 contains potentially dangerous Python code. (languages/python.md:221)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/injection.md at line 132 contains potentially dangerous Python code. (references/injection.md:132)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/injection.md at line 142 contains potentially dangerous Python code. (references/injection.md:142)
• [MDBLOCK_PYTHON_HTTP_POST] Code block in references/supply-chain.md at line 231 contains potentially dangerous Python code. (references/supply-chain.md:231)
• [OBFUSCATION_BASE64_LARGE] Pattern detected: exec(base64.b64decode (references/supply-chain.md:235)
• [OBFUSCATION_BASE64_LARGE] Pattern detected: base64.b64decode(code), '', 'exec (references/supply-chain.md:236)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/supply-chain.md at line 239 contains potentially dangerous Python code. (references/supply-chain.md:239)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/supply-chain.md at line 273 contains potentially dangerous Python code. (references/supply-chain.md:273)

✅ skill-scanner

• Status: Passed
• Findings: 29
• Allowed (not blocking): 9
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)
  • ACTIVE_REMOTE_ACQUIRE_EXECUTE (Allowed: FP: SKILL.md:139 lists 'Scripts that download and execute binaries or code at runtime' as a risk category the skill should flag in other skills. Describing the pattern is the skill's purpose.)
  • MDBLOCK_PYTHON_EVAL_EXEC (Allowed: FP: references/dangerous-code-patterns.md:86, :143, and :149 are example malicious patterns (eval(user_input), base64 and rot13 obfuscated exec) that the skill teaches detection of. The skill documents the pattern it hunts; it does not execute it.)
  • MDBLOCK_PYTHON_EVAL_EXEC (Allowed: FP: references/dangerous-code-patterns.md:86, :143, and :149 are example malicious patterns (eval(user_input), base64 and rot13 obfuscated exec) that the skill teaches detection of. The skill documents the pattern it hunts; it does not execute it.)
  • OBFUSCATION_BASE64_LARGE (Allowed: This is a meta-skill that teaches detection of malicious patterns. Its reference material cites exec(base64.b64decode(...)) as an example of obfuscated code the scanner should flag in other skills — the skill documents the pattern it hunts, it does not execute it.)
  • MDBLOCK_PYTHON_EVAL_EXEC (Allowed: FP: references/dangerous-code-patterns.md:86, :143, and :149 are example malicious patterns (eval(user_input), base64 and rot13 obfuscated exec) that the skill teaches detection of. The skill documents the pattern it hunts; it does not execute it.)
  • PROMPT_INJECTION_UNRESTRICTED_MODE (Allowed: The skill's reference material on prompt-injection patterns cites 'Enter developer mode' as an example jailbreak pattern the skill teaches to detect. Documenting the pattern is the skill's purpose.)
  • YARA_prompt_injection_unicode_steganography (Allowed: The skill documents invisible Unicode steganography (\U000e0001 tag characters) as a prompt-injection vector. Describing the attack class is required for the skill to teach detection of it.)
  • DATA_EXFIL_SENSITIVE_FILE_GLOB (Allowed: FP: scripts/scan_skill.py:475 globs *.png inside the skill directory under review to parse PNG text chunks for hidden metadata. Local read-only inspection of the scanned skill, with no network transmission.)

For review, not blocking: 7 MEDIUM finding(s), 1 file(s) the LLM judge only partly read

• [MDBLOCK_PYTHON_HTTP_POST] Code block in references/dangerous-code-patterns.md at line 11 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:11)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/dangerous-code-patterns.md at line 17 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:17)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/dangerous-code-patterns.md at line 40 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:40)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/dangerous-code-patterns.md at line 45 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:45)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/dangerous-code-patterns.md at line 79 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:79)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/dangerous-code-patterns.md at line 95 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:95)
• [MDBLOCK_PYTHON_SUBPROCESS] Code block in references/dangerous-code-patterns.md at line 157 contains potentially dangerous Python code. (references/dangerous-code-patterns.md:157)

The LLM judge exceeded its context budget on: scripts/scan_skill.py. Review these files manually.

✅ skill-writer

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: Most upstream skill repositories declare their license at the repository root rather than in each SKILL.md's frontmatter. Packaging a skill already requires a maintainer to verify that the upstream license permits redistribution (see AGENTS.md), so the frontmatter field adds nothing to that check.)

---

Summary: Completed 18 of 18 skill scan(s), all passed security checks. ✅

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

LGTM