You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
SKILL.md Step 1 writes literal INPUT_PATH into graphify-out/.graphify_root #72
graphify install --project generates .claude/skills/graphify/SKILL.md verbatim. In that generated file, the Step 1 — Ensure graphify is installed bash block ends with:
# Save scan root so `graphify update` (no args) knows where to look next timeecho"$(cd INPUT_PATH && pwd)"> graphify-out/.graphify_root
INPUT_PATH is a placeholder, but Step 1 carries no substitution instruction. The instruction "Replace INPUT_PATH with the actual path the user provided" appears only after the Step 2 block, and Steps 4/5/9 repeat it for themselves. An agent that follows the file literally runs cd INPUT_PATH, which fails, and — depending on shell — leaves graphify-out/.graphify_root empty or containing the literal string, so any later command that reads it to locate the scan root is wrong.
Expected
Step 1 states the same substitution rule the other steps do, e.g. immediately after the code block:
Replace INPUT_PATH on the last line with the actual path the user provided (. if none was given) — left as the literal placeholder, .graphify_root records the string INPUT_PATH instead of the scan root.
(An alternative fix, arguably better: have Step 1 write $(pwd) or resolve the path in the same Python one-liner that writes .graphify_python, so there is no placeholder to substitute at all.)
Where found
Flagged by an automated reviewer on lawnstarter/customer-platforms PR #14499 (Jira PE-80044), which installs this skill into the customer-platforms monorepo. The identical generated file ships into ~12 LawnStarter repos, so the fix belongs upstream in the generator rather than in each consuming repo. We applied the one-line doc fix locally in that PR as a stopgap.
Triage: canonical issue for the SKILL.md Step 1 work unit.#77 is closed into this issue: both defects live in the same generated fragment (tools/skillgen/fragments/shell/posix.md, mirrored in powershell.md) and one PR fixes both. Verified still present at v8 HEAD 4492f9f (git log 5e9d95c..HEAD -- graphify/skill.md is empty).
Step 1 executes whatever absolute-ish path appears in the console script's shebang, guarded only by a character-class filter — /usr/bin/perl and /tmp/a_b both pass and get executed with -c "import graphify". Narrow the case pattern to python-interpreter basenames. (Defense-in-depth; the accept/reject table in SKILL.md Step 1 executes the graphify binary's shebang behind a character-class filter only (PE-80046) #77 was reproduced in a live shell at HEAD and matches exactly.)
com.lawnstarter.pros PR #14308 already carries this patch as local drift — the fix un-forks that repo.
Fix for this issue proper: either add the INPUT_PATH substitution instruction to Step 1, or eliminate the placeholder by writing .graphify_root from the same Python one-liner that writes .graphify_python. Regenerate every graphify/skill*.md variant and the tools/skillgen/expected/ goldens in the same commit (the skillgen parity check enforces this).
Activity
filipechagas commentedon Aug 11, 2026
Triage: canonical issue for the SKILL.md Step 1 work unit. #77 is closed into this issue: both defects live in the same generated fragment (
tools/skillgen/fragments/shell/posix.md, mirrored inpowershell.md) and one PR fixes both. Verified still present atv8HEAD4492f9f(git log 5e9d95c..HEAD -- graphify/skill.mdis empty).Folded in from #77:
/usr/bin/perland/tmp/a_bboth pass and get executed with-c "import graphify". Narrow the case pattern to python-interpreter basenames. (Defense-in-depth; the accept/reject table in SKILL.md Step 1 executes the graphify binary's shebang behind a character-class filter only (PE-80046) #77 was reproduced in a live shell at HEAD and matches exactly.)com.lawnstarter.prosPR #14308 already carries this patch as local drift — the fix un-forks that repo.uv tool run --from graphifyyfork-shadowing remark in SKILL.md Step 1 executes the graphify binary's shebang behind a character-class filter only (PE-80046) #77 is a design question, not a Step 1 code fix; note it in the PR, do not block on it.Fix for this issue proper: either add the INPUT_PATH substitution instruction to Step 1, or eliminate the placeholder by writing
.graphify_rootfrom the same Python one-liner that writes.graphify_python. Regenerate everygraphify/skill*.mdvariant and thetools/skillgen/expected/goldens in the same commit (the skillgen parity check enforces this).