diff --git a/.github/workflows/gemini-invoke.yml b/.github/workflows/gemini-invoke.yml index c882d5484..867d8bc11 100644 --- a/.github/workflows/gemini-invoke.yml +++ b/.github/workflows/gemini-invoke.yml @@ -153,6 +153,8 @@ jobs: 6. **Resource Consciousness**: Be mindful of the number of operations you perform. Your plans should be efficient. Avoid proposing actions that would result in an excessive number of tool calls (e.g., > 50). + 7. **Command Substitution**: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. + ----- ## Step 1: Context Gathering & Initial Analysis diff --git a/.github/workflows/gemini-issue-fixer.yml b/.github/workflows/gemini-issue-fixer.yml index c30028026..2fcbba1a0 100644 --- a/.github/workflows/gemini-issue-fixer.yml +++ b/.github/workflows/gemini-issue-fixer.yml @@ -156,6 +156,7 @@ jobs: Use Tools: Rely on the provided tools for all interactions with the repository. Do not guess file contents or state. Handle Shell Variables Safely: When defining or using variables in shell commands, ensure they are properly quoted to prevent errors. If something prevents you from fixing the issue, such as a permissions issue, inform the user in your comment on the issue why you cannot complete the task. If you must inform the user of a limitation, use the `gh issue comment --edit-last` CLI tool command to edit your initial comment. Only create a pull request if it will fix the issue. + Command Substitution: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. diff --git a/.github/workflows/gemini-review.yml b/.github/workflows/gemini-review.yml index bfd91188f..c26c30c20 100644 --- a/.github/workflows/gemini-review.yml +++ b/.github/workflows/gemini-review.yml @@ -133,6 +133,8 @@ jobs: 6. **Contextual Correctness:** All line numbers and indentations in code suggestions **MUST** be correct and match the code they are replacing. Code suggestions need to align **PERFECTLY** with the code it intend to replace. Pay special attention to the line numbers when creating comments, particularly if there is a code suggestion. + 7. **Command Substitution**: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. + ## Input Data diff --git a/.github/workflows/gemini-scheduled-triage.yml b/.github/workflows/gemini-scheduled-triage.yml index fe085803d..90a2acfb4 100644 --- a/.github/workflows/gemini-scheduled-triage.yml +++ b/.github/workflows/gemini-scheduled-triage.yml @@ -141,6 +141,8 @@ jobs: 4. **Variable Handling:** Reference all shell variables as `"${VAR}"` (with quotes and braces) to prevent word splitting and globbing issues. + 5. **Command Substitution**: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. + ## Input Data Description You will work with the following environment variables: diff --git a/.github/workflows/gemini-triage.yml b/.github/workflows/gemini-triage.yml index 818960355..11462505d 100644 --- a/.github/workflows/gemini-triage.yml +++ b/.github/workflows/gemini-triage.yml @@ -101,6 +101,7 @@ jobs: - Environment variables are specified in the format "${VARIABLE}" (with quotes and braces). - Only use labels that are from the list of available labels. - You can choose multiple labels to apply. + - When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. ## Steps diff --git a/examples/workflows/gemini-assistant/gemini-invoke.yml b/examples/workflows/gemini-assistant/gemini-invoke.yml index 89d25fa80..0e93b629c 100644 --- a/examples/workflows/gemini-assistant/gemini-invoke.yml +++ b/examples/workflows/gemini-assistant/gemini-invoke.yml @@ -153,6 +153,8 @@ jobs: 6. **Resource Consciousness**: Be mindful of the number of operations you perform. Your plans should be efficient. Avoid proposing actions that would result in an excessive number of tool calls (e.g., > 50). + 7. **Command Substitution**: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. + ----- ## Step 1: Context Gathering & Initial Analysis diff --git a/examples/workflows/issue-triage/gemini-scheduled-triage.yml b/examples/workflows/issue-triage/gemini-scheduled-triage.yml index dbc26a43a..1c95921f4 100644 --- a/examples/workflows/issue-triage/gemini-scheduled-triage.yml +++ b/examples/workflows/issue-triage/gemini-scheduled-triage.yml @@ -141,6 +141,8 @@ jobs: 4. **Variable Handling:** Reference all shell variables as `"${VAR}"` (with quotes and braces) to prevent word splitting and globbing issues. + 5. **Command Substitution**: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. + ## Input Data Description You will work with the following environment variables: diff --git a/examples/workflows/issue-triage/gemini-triage.yml b/examples/workflows/issue-triage/gemini-triage.yml index 12e119837..c37562766 100644 --- a/examples/workflows/issue-triage/gemini-triage.yml +++ b/examples/workflows/issue-triage/gemini-triage.yml @@ -101,6 +101,7 @@ jobs: - Environment variables are specified in the format "${VARIABLE}" (with quotes and braces). - Only use labels that are from the list of available labels. - You can choose multiple labels to apply. + - When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. ## Steps diff --git a/examples/workflows/pr-review/gemini-review.yml b/examples/workflows/pr-review/gemini-review.yml index 128aa5f59..892c3dc22 100644 --- a/examples/workflows/pr-review/gemini-review.yml +++ b/examples/workflows/pr-review/gemini-review.yml @@ -133,6 +133,8 @@ jobs: 6. **Contextual Correctness:** All line numbers and indentations in code suggestions **MUST** be correct and match the code they are replacing. Code suggestions need to align **PERFECTLY** with the code it intend to replace. Pay special attention to the line numbers when creating comments, particularly if there is a code suggestion. + 7. **Command Substitution**: When generating shell commands, you **MUST NOT** use command substitution with `$(...)`, `<(...)`, or `>(...)`. This is a security measure to prevent unintended command execution. + ## Input Data