Skip to content

Comments

Fix shell escaping and add vetting tests#7

Merged
whw merged 3 commits intomainfrom
fix/shell-escaping-and-tests
Feb 9, 2026
Merged

Fix shell escaping and add vetting tests#7
whw merged 3 commits intomainfrom
fix/shell-escaping-and-tests

Conversation

@whw
Copy link
Collaborator

@whw whw commented Feb 9, 2026

Summary

  1. Fix shell escaping - Pass skill content via env var instead of inline substitution to properly handle backticks and other special characters

  2. Add test workflow - Tests the vetting system on infrastructure changes:

    • Triggers on changes to vet-skill.yml or test-vetting.yml
    • Does NOT trigger on skills/** changes
    • Tests a malicious skill (expects FAIL from both models)
    • Tests a safe skill (expects PASS from both models)

Test plan

  • Verify test workflow runs on this PR
  • Verify malicious skill test returns FAIL
  • Verify safe skill test returns PASS
  • Re-test skill submission with special characters (backticks)

whw added 2 commits February 8, 2026 18:12
Pass skill content via env var instead of inline substitution to
properly handle backticks and other special characters in skills.
Tests run on infra changes (workflow files), not skill submissions.
Verifies that:
- Malicious skills get FAIL verdict from both Claude and OpenAI
- Safe skills get PASS verdict from both models
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Feb 9, 2026

Deploying everyskill with  Cloudflare Pages  Cloudflare Pages

Latest commit: 9585b3a
Status: ✅  Deploy successful!
Preview URL: https://244bf729.everyskill.pages.dev
Branch Preview URL: https://fix-shell-escaping-and-tests.everyskill.pages.dev

View logs

@whw whw merged commit 8fe7b71 into main Feb 9, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant