fix: allow AskUserQuestion in the release skill - #247
Conversation
The skill instructs the agent to use AskUserQuestion when the release version is ambiguous, but allowed-tools listed only Bash, Read and Edit. So at the riskiest step - choosing the version number - it could not do the one thing it insists on, and would have had to guess or stall. Found by review on cuioss/cui-test-juli-logger#123, where the same frontmatter had been copied from these skills. All six affected repos are fixed identically. Co-Authored-By: Claude <noreply@anthropic.com>
OliverWolffGIP
added
the
skip-bot-review
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: cuioss/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. This changes the release skill's allowed-tool trust boundary by granting it access to AskUserQuestion. If that permission is wrong, the skill may prompt users unexpectedly or fail to follow the intended release interaction, and reverting removes the permission, but the authorization decision is security-sensitive.
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
2 participants
Problem
Das Release-Skill weist den Agenten an,
AskUserQuestionzu nutzen, wenn die Release-Version mehrdeutig ist — aberallowed-toolslistete nurBash, Read, Edit.Damit konnte es ausgerechnet am riskantesten Schritt — der Wahl der Versionsnummer — genau das nicht tun, worauf es selbst besteht. Es hätte raten oder blockieren müssen.
Fix
Herkunft
Gefunden durch Review auf cuioss/cui-test-juli-logger#123, wo dasselbe Frontmatter aus diesen Skills übernommen worden war. Ein Audit über alle Repos mit Release-Skill zeigte sechs betroffene; alle werden identisch korrigiert.
Reine Dokumentationsänderung — keine Build- oder Quellcode-Auswirkung.