chore(deps): update trailofbits/skills digest to 123037e

[renovate]

This PR contains the following updates:

Package	Update	Change
trailofbits/skills	digest	7b9bd5f → 123037e

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🛡️ Skill Security Scan Results

❌ agentic-actions-auditor

• Status: Failed
• Findings: 1
• Blocking: 1

Blocking issues:

• [LLM_HARMFUL_CONTENT] (HIGH) The GitHub AI Inference remediation guidance labels a run: step that assigns an AI-action output through a GitHub expression inside single quotes as safe. GitHub expressions are expanded before the shell executes. If the AI output is attacker-influenced and includes a single quote, it can terminate the shell string and inject shell syntax. This is particularly dangerous in the documented threat model, where AI output may be influenced through prompt injection. (references/action-profiles.md)

✅ codeql

• Status: Passed
• Findings: 3
• Allowed (not blocking): 2
  • ATR_2026_00010 (Allowed: FP: codeql is a security analysis skill whose reference files contain CodeQL workflow documentation, quality assessment commands, and performance tuning examples. All ATR pattern matches are documentation of analysis procedures, not agent instructions.)
  • ATR_2026_00010 (Allowed: FP: codeql is a security analysis skill whose reference files contain CodeQL workflow documentation, quality assessment commands, and performance tuning examples. All ATR pattern matches are documentation of analysis procedures, not agent instructions.)

❌ differential-review

• Status: Failed
• Findings: 2
• Blocking: 1

Blocking issues:

• [LLM_COMMAND_INJECTION] (CRITICAL) The methodology presents multiple shell commands containing placeholders that will commonly be populated from PR, commit-range, file-name, pattern, or function-name input. If an agent constructs these commands through shell interpolation without strict validation and argument-safe execution, a malicious value can inject shell syntax or Git options, resulting in arbitrary command execution or unintended repository operations. This is particularly relevant because the skill is intended to review user-supplied repositories and requested revision ranges. (methodology.md)

✅ fp-check

• Status: Passed
• Findings: 0

✅ property-based-testing

• Status: Passed
• Findings: 0

✅ sarif-parsing

• Status: Passed
• Findings: 3
• Allowed (not blocking): 1
  • ALLOWED_TOOLS_WRITE_VIOLATION (Allowed: SKILL.md declares Bash in allowed-tools, which transitively permits filesystem writes (e.g. via redirection); the scanner flags bundled scripts as writing without recognizing Bash as the intended mechanism.)

✅ semgrep

• Status: Passed
• Findings: 1

✅ semgrep-rule-creator

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)

✅ semgrep-rule-variant-creator

• Status: Passed
• Findings: 0

✅ sharp-edges

• Status: Passed
• Findings: 1
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

✅ supply-chain-risk-auditor

• Status: Passed
• Findings: 0

✅ variant-analysis

• Status: Passed
• Findings: 1

✅ yara-rule-authoring

• Status: Passed
• Findings: 2
• Allowed (not blocking): 1
  • MANIFEST_MISSING_LICENSE (Allowed: trailofbits/skills is licensed CC-BY-SA-4.0 at the repository root; upstream does not embed a license field in per-skill SKILL.md frontmatter.)

---

Summary: Completed 13 of 13 skill scan(s), found 2 blocking issue(s).

⚠️ Action Required: Review the failed scan jobs and any blocking findings. Add a justified entry to the skill's security.allowed_issues[] only when a finding is a confirmed false positive.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[danbarr]

Security-scan triage: no additional exclusions.

• LLM_SUPPLY_CHAIN_ATTACK (constant-time-analysis): remains blocking. The PHP guide fetches a mutable VLD release or clones from GitHub, then installs a native extension (including sudo make install) without pinning or integrity verification. This is a real supply-chain/elevated-install risk; upstream publisher trust does not mitigate it.
• LLM_COMMAND_INJECTION (zeroize-audit): remains blocking. extract_compile_flags.py forwards compile-database flags and emit_ir.sh passes them to clang. Shell quoting prevents metacharacter injection, but untrusted flags can still load plugins/response files or otherwise execute code. This is a real execution-capable interface, not a false positive.

No files changed; the Renovate digest/version update is preserved.

[danbarr]

Follow-up: I trialed deferring only constant-time-analysis and zeroize-audit. The remaining Trail of Bits set still fails security scanning at codeql; no partial revert or additional exclusion was pushed. The scan output included instruction-like content, which was treated solely as untrusted scan data.

[danbarr]

Correction: deferred the constant-time-analysis and zeroize-audit updates. Final status depends on the authoritative GitHub Trusted Skill Scan.