diff --git a/skills/altimate-code/SKILL.md b/skills/altimate-code/SKILL.md index 2fbab7b..4b3f44e 100644 --- a/skills/altimate-code/SKILL.md +++ b/skills/altimate-code/SKILL.md @@ -32,15 +32,27 @@ altimate-code has multiple agent personas. The default (`builder`) does a full p ### Step 2 — invoke with the chosen agent +Pass the task through a here-doc into a variable so the shell never +command-substitutes anything the user typed (a task like +`refactor `whoami` and $(rm -rf ~)` would otherwise fire `whoami` and +`rm -rf ~` before `altimate-code` ever runs). Write the result to a +private temporary file, not a shared one under `/tmp`: + ```bash -altimate-code run "" \ +TASK="$(cat <<'ALTIMATE_TASK' + +ALTIMATE_TASK +)" +umask 077 +OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)" +altimate-code run "$TASK" \ --agent \ --yolo \ - --output /tmp/altimate-result.md \ + --output "$OUTPUT_FILE" \ --dir "$(pwd)" ``` -Then `Read /tmp/altimate-result.md` and emit its contents to the user without re-summarising, re-formatting, or commenting on the result. altimate-code has already produced the answer. +Then `Read "$OUTPUT_FILE"` and emit its contents to the user without re-summarising, re-formatting, or commenting on the result. altimate-code has already produced the answer. Delete `"$OUTPUT_FILE"` after presenting so warehouse rows, lineage, or PII findings don't linger on disk. ### Required flags @@ -48,18 +60,24 @@ Then `Read /tmp/altimate-result.md` and emit its contents to the user without re |---|---| | `--agent ` | Picks the agent persona. Default `builder` is overkill for simple edits — see the classification table above. Wrong agent = either 10× too expensive (using `builder` on a rename) or wrong-answer (using `fast-edit` on a multi-table join). | | `--yolo` | Non-interactive mode. Without this the subprocess hangs on the first permission prompt and you will time out. | -| `--output /tmp/altimate-result.md` | Captures the final response. Without this you lose the answer to stdout-buffering and can't reliably read it back. | +| `--output "$OUTPUT_FILE"` | Captures the final response. Use the private `mktemp` file from above — do NOT use a fixed path like `/tmp/altimate-result.md`; concurrent sessions clobber each other and a world-readable fixed path leaks data. | | `--dir "$(pwd)"` | Runs altimate-code in the current project so it picks up dbt project config, profiles.yml, etc. | ### Follow-up tasks in the same project -When the user makes a follow-up data task in the same project after a successful altimate-code delegation, prefer `--continue` to resume the warm session instead of starting a fresh one: +When the user makes a follow-up data task in the same project after a successful altimate-code delegation, prefer `--continue` to resume the warm session instead of starting a fresh one. Same here-doc + `mktemp` pattern: ```bash -altimate-code run "" \ +TASK="$(cat <<'ALTIMATE_TASK' + +ALTIMATE_TASK +)" +umask 077 +OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)" +altimate-code run "$TASK" \ --agent \ --yolo \ - --output /tmp/altimate-result.md \ + --output "$OUTPUT_FILE" \ --dir "$(pwd)" \ --continue # resumes the most recent session in this dir ``` diff --git a/skills/altimate-code/commands/altimate.md b/skills/altimate-code/commands/altimate.md index 391314d..ee80180 100644 --- a/skills/altimate-code/commands/altimate.md +++ b/skills/altimate-code/commands/altimate.md @@ -25,27 +25,43 @@ Workflow (follow in order, no skipping): Decision rule: start with `fast-edit`. Only use `analyst` / `builder` when the cheap path fails for a documented reason. -3. **Run altimate-code with the chosen agent:** +3. **Run altimate-code with the chosen agent.** Pass `$ARGUMENTS` through a + here-doc into a variable so the shell never command-substitutes anything the + user typed, and write the result to a private `mktemp` file (not a shared + `/tmp/altimate-result.md` — concurrent invocations clobber each other and a + world-readable fixed path leaks warehouse rows or PII): ```bash - altimate-code run "$ARGUMENTS" \ + TASK="$(cat <<'ALTIMATE_TASK' + $ARGUMENTS + ALTIMATE_TASK + )" + umask 077 + OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)" + altimate-code run "$TASK" \ --agent \ --yolo \ - --output /tmp/altimate-result.md \ + --output "$OUTPUT_FILE" \ --dir "$(pwd)" ``` **If this is a follow-up task in the same project** (the user invoked `/altimate` already in this conversation about the same dbt project / warehouse / data context), add `--continue` to resume the warm session — cache is hot, follow-on cost is materially lower: ```bash - altimate-code run "$ARGUMENTS" \ + TASK="$(cat <<'ALTIMATE_TASK' + $ARGUMENTS + ALTIMATE_TASK + )" + umask 077 + OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)" + altimate-code run "$TASK" \ --agent \ - --yolo --output /tmp/altimate-result.md --dir "$(pwd)" \ + --yolo --output "$OUTPUT_FILE" --dir "$(pwd)" \ --continue ``` Skip `--continue` if the user switched projects, switched debugging threads, or this is the first `/altimate` invocation in the conversation. -4. **Surface the result verbatim:** read `/tmp/altimate-result.md` and present its contents to the user without re-summarising, re-formatting, or commenting. altimate-code has already produced the answer. +4. **Surface the result verbatim:** read `"$OUTPUT_FILE"` and present its contents to the user without re-summarising, re-formatting, or commenting. altimate-code has already produced the answer. Delete `"$OUTPUT_FILE"` after presenting so warehouse rows, lineage, or PII findings don't linger on disk. 5. **On any altimate-code error** (`Unauthorized`, `Token limit reached`, `No provider configured`, warehouse credentials wrong, process timeout) — surface the error message to the user along with the fix from the skill body's failure-modes table. Do NOT fall back to native tools. The user invoked `/altimate` specifically to use altimate-code; falling back would defeat the purpose.