Repository Issue Activity (beta)

#1643 Proposal: codehealth-mcp, a maintainability gate at agent checkpoints

#1252 Bug: `product-self-knowledge` skill falls through to open web search when docs URL fetch fails

#1559 skill-creator run_eval.py reports 0% trigger rate for working descriptions

#1631 Path traversal via unsanitized skill_name in run_eval.py

#1621 MCPConnectionSSE / MCPConnectionHTTP accept arbitrary caller-supplied URLs and headers with no validation Affected file: mcp-builder/scripts/connections.py (lines 88–109)

#1626 https://github.com/Aperivue

#1625 Command injection via shell=True in with_server.py --server argument

#1624 claude-api: SKIP grep is unanchored — `cohere` matches "coherent", disabling the skill in any repo that uses the word

#1622 claude-api skill: description exceeds pi.dev's 1024-char frontmatter cap (1077 chars)

#1620 Shell command injection via --server argument (with_server.py, shell=True) Affected file: webapp-testing/scripts/with_server.py (lines 69–74)

#1619 MCPConnectionStdio passes caller-supplied command/args directly to subprocess spawn with no validation Affected file: mcp-builder/scripts/connections.py (lines 76–85)

#1618 Path traversal in the resource-handler example (python_mcp_server.md) — unsanitized URI template parameter used directly in a filesystem path Affected file: mcp-builder/reference/python_mcp_server.md (Resource Registration section, ~line 527–541)

#1617 fill_fillable_fields.py silently overwrites existing files (no output-path check) Affected file: pdf/scripts/fill_fillable_fields.py Related doc: pdf/forms.md (lines 74–76, instructs the agent to invoke the script with a caller-supplied output path)

#1613 claude-api: frontmatter description exceeds 1024-character limit

#1078 pdf skill: `pdftotext -layout` column-drift on multi-page positional "tables"

#1603 claude-api skill: five model IDs in models.md now return 404, one listed under "still active"

#1594 Gopay indonesia anonymus.300199

#1304 Windows: eval/optimize harness broken — cp1252 read_text() crash + nested claude -p WinError 10038 silently zeroes all results

#1383 skill-creator: silent benchmark failures (layout mismatch, inverted delta), broken trigger evals on Windows, and skill shadowing in trigger evals

#1394 skill-creator: eval-viewer escapeHtml is not attribute-safe and is applied inconsistently (display-path XSS)

#1390 mcp-builder: evaluation.py scores 0/N against any real MCP server (TextContent not JSON serializable, swallowed into fabricated tool errors)

#1412 skill-creator: description-optimization loop burned 100% of a Max subscription in ~3 minutes — false-negative eval bug + no cost guardrails

#1419 skill-creator trigger eval scores 0% recall when the skill is already installed (and under parallel workers)

#1362 web-artifacts-builder: bundle/init scripts fail on pnpm ≥10.1 (ERR_PNPM_IGNORED_BUILDS); stale favicon strip; fonts not inlined

#1552 skill-creator: description optimizer reports ~0% recall for skills that actually do trigger