Vince Lozada 732ab95906 security: address HIGH/MEDIUM findings from skills.sh audit (#35) ...

* security: address HIGH/MEDIUM findings from skills.sh audit

- Remove eval from mr-review-workflow.sh; add command allowlist
- Replace direct config file parsing with glab auth token in add-inline-comment.sh
- Add external content boundary markers to create-mr-from-issue.sh and ci-debug.sh
- Add private key upload warning to glab-ssh-key/SKILL.md
- Add prompt injection warnings to glab-api, glab-ci, glab-job SKILL.md files
- Add SECURITY.md with full security policy and guidance

Fixes #34

* chore: exclude SECURITY.md from zip export

---------

Co-authored-by: Steven (Bot) <steven@winkintel.com>

2026-03-04 19:41:38 -06:00

..

references

Add skills for remaining glab commands

2026-01-30 21:45:25 +00:00

SKILL.md

security: address HIGH/MEDIUM findings from skills.sh audit (#35)

2026-03-04 19:41:38 -06:00