v4-readiness
Generates a v4 upgrade readiness checklist for forks, ensuring operators are prepared for changes before the v4 release.
Install this skill
Security score
The v4-readiness skill was audited on May 30, 2026 and we found 24 security issues across 1 threat category, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 8 | > **${var}** — Optional. Pass `dry-run` to skip the notification (article still writes, log still appends). Pass a fork repo slug (e.g. `someuser/aeon`) to read remote `aeon.yml` + `skills.json` from |
Template literal with variable interpolation in command context
| 29 | No new secrets. No new env vars. No new state files. Pure local file I/O over the fork's own working tree, plus optional `gh api` for the `${var}=owner/repo` remote-survey mode. |
Template literal with variable interpolation in command context
| 39 | - `articles/v4-readiness-${today}.md` — the full per-fork readiness report. |
Template literal with variable interpolation in command context
| 40 | - `memory/logs/${today}.md` — log block. |
Template literal with variable interpolation in command context
| 42 | If `${var}` is a fork slug instead of `dry-run` or empty, replace every local file read with `gh api repos/${var}/contents/<path>` and decode the base64 content. Custom-skill scan via `gh api repos/${ |
Template literal with variable interpolation in command context
| 55 | | `articles/${skill}-${today}.md` output convention | per-skill | Consumed by chains, dashboard, syndicate-article — too many readers to break | |
Template literal with variable interpolation in command context
| 58 | | `${today}` template variable | SKILL.md prose | Substituted by the runner; no plan to change | |
Template literal with variable interpolation in command context
| 73 | | MCP server tool naming (`aeon-${skill_slug}`) | `mcp-server/src/index.ts` | Naming convention for forks consuming the MCP | |
Template literal with variable interpolation in command context
| 99 | - If `${var}` matches `^dry-run$` → `MODE=dry-run`. No notification, article still writes. |
Template literal with variable interpolation in command context
| 100 | - Else if `${var}` matches `^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$` → `MODE=remote`, `TARGET=${var}`. All file reads go through `gh api repos/${TARGET}/contents/...`. |
Template literal with variable interpolation in command context
| 101 | - Else if `${var}` is empty → `MODE=local`, `TARGET=$(gh repo view --json nameWithOwner --jq .nameWithOwner)`. |
Template literal with variable interpolation in command context
| 102 | - Anything else → log `V4_READINESS_BAD_VAR: ${var}` and exit (no notify, no article). |
Template literal with variable interpolation in command context
| 114 | | `aeon.yml` | direct read | `gh api repos/${TARGET}/contents/aeon.yml --jq .content \| base64 -d` | |
Template literal with variable interpolation in command context
| 117 | | Custom skills | `ls skills/` minus skills present in `skills.json` install rows | `gh api repos/${TARGET}/contents/skills` JSON | |
Template literal with variable interpolation in command context
| 137 | For each custom-skill candidate: confirm it exists on disk (`skills/${name}/SKILL.md`) and is **not** present in the upstream-fingerprint heuristic (skills with `install: ./add-skill aaronjmars/aeon $ |
Template literal with variable interpolation in command context
| 156 | Path: `articles/v4-readiness-${today}.md`. Overwrite if exists. |
Template literal with variable interpolation in command context
| 158 | ```markdown |
Template literal with variable interpolation in command context
| 221 | ``` |
Template literal with variable interpolation in command context
| 242 | ### 8. Log to `memory/logs/${today}.md` |
Template literal with variable interpolation in command context
| 244 | ``` |
Template literal with variable interpolation in command context
| 266 | | `V4_READINESS_BAD_VAR` | `${var}` was non-empty, non-`dry-run`, not a `owner/repo` slug | No | |
Template literal with variable interpolation in command context
| 272 | **Remote mode (`var=owner/repo`).** Each input read is a single `gh api repos/${TARGET}/contents/${path}` call. `gh` handles auth via the workflow's `GITHUB_TOKEN`, so there is no env-var-in-curl patt |
Piping content to bash shell
| 53 | | `./notify "message"` interface | bash | Operator-facing CLI; documented in CLAUDE.md | |
Piping content to bash shell
| 57 | | `gh api` and `gh pr create` usage in skills | bash | GitHub CLI is stable; sandbox workaround for env-var-in-headers | |