AntFleet

Disagreement · 18907f89-anthropic-4

Bash arithmetic comparison `[ "$CHAINS" -gt 0 ]` on potentially empty string in fleet postflight

solo Opus
repo 6f7fc663·PR #31·reviewed 1 week ago

Opus finding

Bash arithmetic comparison `[ "$CHAINS" -gt 0 ]` on potentially empty string in fleet postflight

lowbughigh
  • .github/workflows/aeon.yml:360-369
If the response is HTTP 201 but the body lacks a `chainsDetected` field, jq emits `null | length` which yields 0 — okay. But if the body is malformed (jq fails), CHAINS could be empty, and `[ "" -gt 0 ]` triggers a bash error under `set -euo pipefail`, failing the always-runs postflight step and turning a non-fatal signal into a job failure. The step is gated `if: always()` and is supposed to be non-fatal; an exit here will mark the job failed even though the skill ran successfully.

Recommendation

Guard with default: `CHAINS=${CHAINS:-0}` and validate it's numeric before the arithmetic test; or remove `set -euo pipefail` for the comparison block.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →