This release adds 1 notable feature for engineering teams evaluating rollout.
Published 20d
AI Agents & Assistants
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
agents
dsl
llm
mcp
skills
workflow
Summary
AI summaryNew lint advisory flags unsafe appending of structured values to string accumulators.
Full changelog
Upgrade impact: none (additive). New tier-3 advisory (info); never blocks compilation.
- New lint
append-structured-to-string(tier-3 advisory) — flags$append VAR ${REF}whereVARis a string accumulator and${REF}is a bare$op output (a possibly-structured list/object) carrying no.fieldaccessor and no|jsonfilter. Appending a structured value to a string stringifies and fragments it — an array-of-objects comma-splits into a mangled, double-escaped blob. Found dogfoodingenter-project($append DOMAIN_INSTRUCTIONS ${DI}withDI=amp_list_memories's array-of-records; Perry proposalc052581b). The fix is pure authoring, which the message points at: project a scalar field (${REF.detail}) or serialize explicitly (${REF|json}) — both suppress the advisory. It's the$append-side sibling ofobject-iteration-advisoryand reuses the same origin analysis; advisory, not warning, because a$op's return shape is statically unknowable (a warning would over-fire on legitimate string→string appends). String-target typing reusesappend-to-non-list's static-init reasoning.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Skillscript
All releases →Related context
Related tools
Earlier breaking changes
- v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).
Beta — feedback welcome: [email protected]