Bundled third-party gitops-repo-audit skill evaluates an untrusted dotenv as shell

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

A CodeRabbit 🟠 Major review finding on #162 flags load_envsubst() in the bundled gitops-repo-audit skill: it evaluates the file passed to --envsubst as shell under set -o allexport, so validating a repository whose dotenv file has been modified can run arbitrary commands in the developer's or CI's process. I verified the code at the PR head — the finding is technically valid, not a false positive.

Why this is not a fix we can just make here

gitops-repo-audit is not ours. Its SKILL.md records metadata.github-repo: https://github.com/fluxcd/agent-skills, and its file history in this repository is a series of chore(deps): update agent skills sync commits. A patch applied here is re-pulled over by the next updater run — silently: no conflict, no CI failure, no signal. Sending the fix to the wrong repository is the failure mode the ownership rules exist to prevent, so this issue exists to stop the next reviewer or agent doing exactly that.

Who this affects

Anyone who runs the gitops-repo-audit skill against a repository they do not fully control, plus any CI that does. We ship the skill, so bundling it is our decision even though the code is not.

Options

1. Report it upstream to fluxcd/agent-skills. The right long-term home. Opening an issue or PR on a third-party repository is gated on the maintainer clearing the professional-work boundary for that repository and then approving the artifact, so an unattended run cannot do this — it needs a decision.
2. Stop bundling the skill (or the script) until upstream fixes it.
3. Carry a local patch the updater will not revert — only viable if the updater grows a way to pin or exclude a file; otherwise it is option 1 with extra steps.

Acceptance criteria

• A decision is recorded on which of the three options we take.
• If option 1: the upstream report exists and is linked here, and this issue carries a conforming **Blocker:** line naming it.
• If option 2: the skill or script is no longer shipped from this marketplace, and the removal is reflected in the plugin README and manifest.
• The CodeRabbit thread on chore(deps): update agent skills #162 is not re-opened by a later sync silently re-introducing the same code without anyone noticing.

Size

Small for the decision; the work depends entirely on which option is chosen.

Part of #38

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• gitops-repo-audit validator evaluates the dotenv file as shell #172

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!