chore(deps): update getsentry/skills digest to c2f99a5

[renovate]

This PR contains the following updates:

Package	Update	Change
getsentry/skills	digest	6abccd6 → c2f99a5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ agents-md

• Status: Passed
• Findings: 0

❌ claude-settings-audit

• Status: Failed
• Findings: 18
• Blocking: 4

Blocking issues:

• [LLM_COMMAND_INJECTION] (HIGH) The skill categorizes make -n as read-only. Although dry-run avoids executing ordinary recipe lines, GNU Make expands constructs while parsing makefiles; in particular, a repository Makefile can contain $(shell ...) expressions that execute commands even when -n is used. Auditing an untrusted or compromised repository can thus cause arbitrary local command execution. (SKILL.md)
• [LLM_DATA_EXFILTRATION] (HIGH) The proposed Bash(cat:*), Bash(find:*), Bash(head:*), Bash(tail:*), and similar wildcard permissions allow reading arbitrary paths supplied as command arguments. They are not intrinsically confined to the repository being audited. If accepted as agent-wide command permissions, these entries could be used to read SSH keys, cloud credentials, environment files, or other sensitive local files while appearing to use an approved read-only command. (SKILL.md)
• [LLM_UNAUTHORIZED_TOOL_USE] (HIGH) The baseline allow list describes its entries as read-only, but gh api is a generic GitHub API client. With arbitrary arguments allowed, it can send POST, PATCH, PUT, and DELETE requests using the operator's authenticated GitHub credentials. A generated settings file would therefore authorize repository, issue, pull-request, workflow, or organization changes rather than only read operations. (SKILL.md)
• [META_DETECTED] (HIGH) The baseline recommendation includes Bash(gh api:*). GitHub CLI's gh api can issue POST, PUT, PATCH, and DELETE requests and accept arbitrary fields or request bodies. This can modify repositories, issues, pull requests, organization settings, and other resources accessible to the user's GitHub token. In combination with unrestricted cat:*, it can also form a local-read-to-network transmission path. (SKILL.md:91)

✅ code-review

• Status: Passed
• Findings: 0

✅ code-simplifier

• Status: Passed
• Findings: 0

✅ commit

• Status: Passed
• Findings: 0

✅ create-branch

• Status: Passed
• Findings: 0

✅ django-access-review

• Status: Passed
• Findings: 0

✅ django-perf-review

• Status: Passed
• Findings: 0

✅ doc-coauthoring

• Status: Passed
• Findings: 0

✅ find-bugs

• Status: Passed
• Findings: 5
• Allowed (not blocking): 3
  • ATR_2026_00051 (Allowed: False positive (excessive_autonomy) - matches ordinary quantifier words ('all files', 'All database', 'EVERY item', 'Unbounded operations', 'every file') inside a read-only security-review checklist enumerating what to inspect (attack surface mapping and a DoS checklist item literally named 'Unbounded operations'), not instructions granting the agent broad destructive authority.)
  • ATR_2026_00051 (Allowed: False positive (excessive_autonomy) - matches ordinary quantifier words ('all files', 'All database', 'EVERY item', 'Unbounded operations', 'every file') inside a read-only security-review checklist enumerating what to inspect (attack surface mapping and a DoS checklist item literally named 'Unbounded operations'), not instructions granting the agent broad destructive authority.)
  • ATR_2026_00051 (Allowed: False positive (excessive_autonomy) - matches ordinary quantifier words ('all files', 'All database', 'EVERY item', 'Unbounded operations', 'every file') inside a read-only security-review checklist enumerating what to inspect (attack surface mapping and a DoS checklist item literally named 'Unbounded operations'), not instructions granting the agent broad destructive authority.)

✅ gh-review-requests

• Status: Passed
• Findings: 0

✅ gha-security-review

• Status: Passed
• Findings: 0

❌ iterate-pr

• Status: Failed
• Findings: 4
• Blocking: 1

Blocking issues:

• [LLM_PROMPT_INJECTION] (HIGH) The workflow retrieves externally supplied PR review comments, issue comments, check descriptions, and failed CI logs, then directs the agent to treat high/medium feedback as work to fix immediately and to commit and push the resulting changes. These external sources can contain adversarial instructions disguised as review feedback or log output. The skill does not require the agent to treat retrieved text as untrusted data, validate that requested changes are relevant to the stated PR objective, or obtain confirmation before making and pushing changes. A malicious commenter, compromised review bot, or attacker-controlled CI output could therefore attempt to manipulate the agent into making unrelated or unsafe repository changes. (SKILL.md)

✅ pr-writer

• Status: Passed
• Findings: 1

✅ prompt-optimizer

• Status: Passed
• Findings: 1

✅ security-review

• Status: Passed
• Findings: 0

✅ skill-scanner

• Status: Passed
• Findings: 0

✅ skill-writer

• Status: Passed
• Findings: 1

---

Summary: Scanned 18 skill(s), found 5 blocking issue(s).

⚠️ Action Required: Review the blocking findings. Add a justified entry to the skill's security.allowed_issues[] in its spec.yaml if the finding is a false positive.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.