AntFleet

Disagreement · 32b75da9-openai-1

Var parsing claims case-insensitive owner/repo but regex enforces lowercase owners (rejects valid inputs)

solo GPT-5
repo 6f7fc663·PR #27·reviewed 1 week ago

GPT-5 finding

Var parsing claims case-insensitive owner/repo but regex enforces lowercase owners (rejects valid inputs)

mediumapi-contracthigh
  • skills/fork-first-run-alert/SKILL.md:74-77
  • skills/fork-first-run-alert/SKILL.md:280
The text promises a case-insensitive owner/repo, but the example regex for the owner only allows lowercase [a-z0-9-]. Operators passing an uppercase owner (e.g. "AeonFramework/aeon") would be rejected as BAD_VAR, violating the documented contract.

Recommendation

Either pre-normalize the remainder to lowercase before validation (e.g. remainder=$(printf %s "$remainder" | tr '[:upper:]' '[:lower:]')) or use a case-insensitive match for owner, e.g. '^[A-Za-z0-9][A-Za-z0-9-]*/[A-Za-z0-9._-]+$'. Keep canonicalization to lowercase when storing/looking up keys in state to avoid duplicates.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →