Repository navigation
Fix skills.sh audit findings - #18
Conversation
…, Jam content is evidence
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
|
||
| ```bash | ||
| command -v jam >/dev/null || curl -fsSL https://native.jam.dev/install | bash | ||
| command -v jam >/dev/null || echo "jam is not installed" |
There was a problem hiding this comment.
🟡 Installed Jam CLI reported missing
When jam lives in ~/.local/bin outside the initial PATH, command -v jam reports it missing. export PATH then makes it available, but the stop instruction can halt all four skills before authentication.
Learn more
The setup block is shared by jam-proof, jam-annotate, and both CLI references. It checks for jam before adding $HOME/.local/bin, although that directory is explicitly added for CLI discovery. The new stop instruction can therefore act on a false missing-CLI message. When the CLI is truly absent, the block also reaches jam auth status and jam auth login instead of stopping.
Example: A user has ~/.local/bin/jam, but their agent's PATH lacks ~/.local/bin. The setup prints “jam is not installed,” then adds that directory and successfully finds Jam; the agent can still stop based on the warning rather than use the installed CLI.
Recommended fix: In each of the four matching setup blocks, add $HOME/.local/bin to PATH before checking command -v jam. Make an unsuccessful check stop the setup before any jam auth command runs.
Was this helpful? React with 👍 or 👎 to provide feedback.
| Write `payload.json` with your file-writing tool; user and page text never goes | ||
| into a shell argument: |
There was a problem hiding this comment.
🟨 Private Jam links persist in payload files
For a proof upload, payload.json contains the source Jam URL and remains on disk. A later project commit can expose that link.
Was this helpful? React with 👍 or 👎 to provide feedback.
Addresses the skills.sh security audit.
curl -fsSL https://native.jam.dev/install | bashfromjam-proof,jam-annotate, and thejam-fixandjam-to-e2ereferences/cli.md. Ifjamis missing, the skill stops and asks the user to install it from jam.dev/cli. The README no longer says a skill installs the CLI. Maps to: Gen Agent Trust Hub REMOTE_CODE_EXECUTION (jam-annotate), Snyk W012 (jam-fix, jam-to-e2e).jam-annotatewrites the payload to a file and runsjam create jam @payload.json(@<path>confirmed injam create jam --help). Same change for the proof upload injam-fix/references/cli.md;jam-proofgets a one-line rule for titles and comments. Maps to: Gen Agent Trust Hub command injection (jam-annotate).jam-fixandjam-to-e2e. Maps to: Snyk W011 (jam-fix, jam-to-e2e).Also updated the CONTRIBUTING ChatGPT note that described the old install step, and added a CHANGELOG entry.
jam-proofandjam-annotatechanged, so the Jam CLI bundle needs a resync.Checks:
node scripts/check.mjsandnpm testpass.