chore(deps): update atlassian/forge-skills digest to 4f04ae0

[renovate]

This PR contains the following updates:

Package	Update	Change
atlassian/forge-skills	digest	a8eb109 → 4f04ae0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

❌ forge-app-builder

• Status: Failed
• Findings: 5
• Blocking: 4

Blocking issues:

• [LLM_UNAUTHORIZED_TOOL_USE] (HIGH) The skill instructions require explicit authorization immediately before non-interactive creation because Forge terms and potentially billing-related consent are consequential external actions. However, the creation helper unconditionally appends --accept-terms whenever a developer-space ID is provided. A caller invoking the helper can therefore cause consent to be accepted without a dedicated confirmation gate implemented by the script. (scripts/create_forge_app.py)
• [LLM_COMMAND_INJECTION] (CRITICAL) The deployment helper builds shell command strings using user-controlled CLI arguments and executes them with shell=True. Values such as --env, --site, --product, --developer-space-id, and --show-logs-related parameters can be interpolated into shell syntax. An attacker able to influence these arguments can inject shell operators or additional commands, resulting in arbitrary command execution in the local agent/user environment. (scripts/deploy_forge_app.py)
• [LLM_UNAUTHORIZED_TOOL_USE] (HIGH) The deployment helper executes deployment and installation based solely on supplied command-line arguments. It does not require a confirmation step that restates the app, environment, target site, selected products, permission/version impact, and intended action. This conflicts with the manifest instructions requiring explicit authorization and exact-target confirmation immediately before deploy or install. The risk is amplified because the helper detects additional Jira/Confluence products and installs to all detected products automatically. (scripts/deploy_forge_app.py)
• [COMMAND_INJECTION_SHELL_TRUE] (HIGH) Pattern detected: subprocess.run(
  cmd,
  shell=True (scripts/deploy_forge_app.py:68)

✅ forge-app-review

• Status: Passed
• Findings: 2

❌ forge-debugger

• Status: Failed
• Findings: 4
• Blocking: 2

Blocking issues:

• [LLM_COMMAND_INJECTION] (CRITICAL) The instructions direct the agent to execute commands containing placeholders derived from user input, including an Atlassian site URL and application directory. Examples include --site <url>, --site <customer-site>, and cd <app-dir> && .... If an agent substitutes these values into a shell command rather than using a structured argument API or strict validation, shell metacharacters or command substitutions in the supplied value can lead to arbitrary command execution. (SKILL.md)
• [LLM_UNAUTHORIZED_TOOL_USE] (HIGH) The skill explicitly instructs the agent to execute all diagnostic and remediation commands immediately without asking the user. This includes deploying application changes, installing/upgrading packages globally, running package scripts, modifying source code to add logging, and installing/upgrading Forge apps. These are consequential operations that can alter a project, production-adjacent environments, installed-app permissions, and the local development environment without user approval. (SKILL.md)

---

Summary: Completed 3 of 3 skill scan(s), found 6 blocking issue(s).

⚠️ Action Required: Review the failed scan jobs and any blocking findings. Add a justified entry to the skill's security.allowed_issues[] only when a finding is a confirmed false positive.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

Security triage complete — no new exclusions added.

Remaining blocking findings:

• forge-app-builder: LLM_UNAUTHORIZED_TOOL_USE (creation) — helper accepts Forge terms non-interactively via --accept-terms, without an immediate consent gate.
• forge-app-builder: LLM_COMMAND_INJECTION and COMMAND_INJECTION_SHELL_TRUE — deployment helper interpolates CLI inputs into commands executed with shell=True; this is a real host command-injection path.
• forge-app-builder: LLM_UNAUTHORIZED_TOOL_USE (deployment) — deploy/install proceeds without target/permission confirmation and may install detected additional products.
• forge-debugger: LLM_COMMAND_INJECTION — user-derived site/path placeholders are placed in shell command examples without validation/structured execution.
• forge-debugger: LLM_UNAUTHORIZED_TOOL_USE — the explicit execution mandate directs consequential deploy, install, package, and source-change actions without user confirmation.

The upstream publisher is trustworthy and the repository is Apache-2.0 licensed, but neither mitigates these concrete behaviors. Validated all three pinned skills with task validate-skill.