Repository navigation
Bundled third-party gitops-repo-audit skill evaluates an untrusted dotenv as shell #178
Description
🤖 Generated by the Agentic Engineer
Evidence
A CodeRabbit 🟠 Major review finding on #162 flags load_envsubst() in the bundled gitops-repo-audit skill: it evaluates the file passed to --envsubst as shell under set -o allexport, so validating a repository whose dotenv file has been modified can run arbitrary commands in the developer's or CI's process. I verified the code at the PR head — the finding is technically valid, not a false positive.
Why this is not a fix we can just make here
gitops-repo-audit is not ours. Its SKILL.md records metadata.github-repo: https://github.com/fluxcd/agent-skills, and its file history in this repository is a series of chore(deps): update agent skills sync commits. A patch applied here is re-pulled over by the next updater run — silently: no conflict, no CI failure, no signal. Sending the fix to the wrong repository is the failure mode the ownership rules exist to prevent, so this issue exists to stop the next reviewer or agent doing exactly that.
Who this affects
Anyone who runs the gitops-repo-audit skill against a repository they do not fully control, plus any CI that does. We ship the skill, so bundling it is our decision even though the code is not.
Options
- Report it upstream to
fluxcd/agent-skills. The right long-term home. Opening an issue or PR on a third-party repository is gated on the maintainer clearing the professional-work boundary for that repository and then approving the artifact, so an unattended run cannot do this — it needs a decision. - Stop bundling the skill (or the script) until upstream fixes it.
- Carry a local patch the updater will not revert — only viable if the updater grows a way to pin or exclude a file; otherwise it is option 1 with extra steps.
Acceptance criteria
- A decision is recorded on which of the three options we take.
- If option 1: the upstream report exists and is linked here, and this issue carries a conforming
**Blocker:**line naming it. - If option 2: the skill or script is no longer shipped from this marketplace, and the removal is reflected in the plugin README and manifest.
- The CodeRabbit thread on chore(deps): update agent skills #162 is not re-opened by a later sync silently re-introducing the same code without anyone noticing.
Size
Small for the decision; the work depends entirely on which option is chosen.
Part of #38
Activity
coderabbitai commentedon Sep 1, 2026
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
devantler commentedon Sep 5, 2026
Closing as a duplicate of #164 — the decision this issue asked for has been taken
Option 2 was chosen and shipped. #184 (merged 2026-09-02T02:28Z, one day after this issue was filed) retired the bundled
gitops-repo-auditskill and publishedgitops-kubernetesunder a fresh version, so the marketplace no longer ships the-Edotenv sink. Verified today againstmain@744f0e06: nogitops-repo-auditpath exists anywhere in the tree.Against the acceptance criteria:
**Blocker:**line) tracks the remaining upstream question.gh skill update --dir plugins, which refreshes skills that are installed; a removed skill has nothing to update. Three post-removal runs (2026-09-03, 09-04, 09-05) produced no update branch.What remains — whether to authorize the upstream
fluxcd/agent-skillsreport, and the sibling copy still live indevantler-tech/platform— is exactly #164's scope, so keeping two issues open for one decision only recreates the four-way duplication #164 already had to consolidate.