Skip to content

Skillscript

v0.26.4 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agents dsl llm mcp skills workflow

Summary

AI summary

New lint advisory flags unsafe appending of structured values to string accumulators.

Full changelog

Upgrade impact: none (additive). New tier-3 advisory (info); never blocks compilation.

  • New lint append-structured-to-string (tier-3 advisory) — flags $append VAR ${REF} where VAR is a string accumulator and ${REF} is a bare $ op output (a possibly-structured list/object) carrying no .field accessor and no |json filter. Appending a structured value to a string stringifies and fragments it — an array-of-objects comma-splits into a mangled, double-escaped blob. Found dogfooding enter-project ($append DOMAIN_INSTRUCTIONS ${DI} with DI = amp_list_memories's array-of-records; Perry proposal c052581b). The fix is pure authoring, which the message points at: project a scalar field (${REF.detail}) or serialize explicitly (${REF|json}) — both suppress the advisory. It's the $append-side sibling of object-iteration-advisory and reuses the same origin analysis; advisory, not warning, because a $ op's return shape is statically unknowable (a warning would over-fire on legitimate string→string appends). String-target typing reuses append-to-non-list's static-init reasoning.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Skillscript

Get notified when new releases ship.

Sign up free

About Skillscript

All releases →

Related context

Earlier breaking changes

  • v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).

Beta — feedback welcome: [email protected]