Skip to content
skillsafebeta
← Report library
Purpose / Development

Fix Errors Skill Security Audit

What the author says it does (original text)

Fix compilation errors, linting issues, and test failures in the warp Rust codebase. Covers presubmit checks, WASM-specific errors, and running specific tests. Use when the user hits build errors, clippy or fmt failures, test failures, or needs to run or interpret presubmit before a PR.

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Presubmit and Cargo commands execute programs controlled by the checked-out repository

Source references: 2
What we found

`./script/presubmit` directly executes a repository script. Cargo tests can also compile and run project tests, build scripts, and related tooling. The supplied material does not include the presubmit script, so its exact actions cannot be confirmed in this audit.

Why this matters

If the Skill is used in an untrusted or tampered checkout, those commands could use the agent's existing permissions to read or change accessible files, use credentials present in the environment, or fetch dependencies. There is no evidence here that this has occurred.

These are live operational instructions, not warnings. `./script/presubmit` executes a repository-supplied script whose contents are absent, so this audit cannot determine what it reads, changes, or contacts; Cargo tests also compile and run project code. A user can ask the author to disclose and explain the script, or permit execution only after review and in isolation.

SKILL.md:23In the instructionsOpen original file
Run all presubmit checks at once:```bash./script/presubmit```This runs formatting, linting, and all tests. If it passes, you're ready to open a PR.
Show 1 other places
SKILL.md:56In the instructionsOpen original file
**All tests:**```bashcargo nextest run --no-fail-fast --workspace --exclude command-signatures-v2cargo nextest run -p warp_completer --features v2```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Unscoped `cargo fmt` can rewrite files unrelated to the requested fix

Source references: 2
What we found

The checking section uses non-writing `cargo fmt -- --check`, but the post-fix instruction requires running the writing form `cargo fmt` every time. It does not require package scoping, checking existing workspace changes, or obtaining user confirmation first.

Why this matters

In a large workspace or one with existing uncommitted edits, formatting can produce broad file changes, mix with the user's ongoing work, and enlarge the final patch.

The earlier formatting command uses `--check`, but the later instruction explicitly requires `cargo fmt` without it. In a Rust workspace, that can rewrite source files outside the immediate fix, including existing user changes. A user can require check-only formatting, or allow write-mode formatting only after reviewing the affected files and preserving uncommitted work.

SKILL.md:35In the instructionsOpen original file
**Rust formatting:**```bashcargo fmt -- --check```
Show 1 other places
SKILL.md:177In the instructionsOpen original file
**After fixing:**- Always run `cargo fmt` and `cargo clippy` before pushing- Run the full presubmit script before opening or updating a PR. Use the `create-pr` skill for more detailed instructions- Verify tests pass in the areas you modified
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

Conditional test skipping and warning suppression can reduce coverage for some configurations

Source references: 3
What we found

The Skill explicitly shows placing tests behind the `local_fs` feature and allowing dead code when that feature is disabled. This can be appropriate for genuine filesystem dependencies, but it does not require proof that a test is inapplicable or replacement coverage for the WASM path.

Why this matters

If an agent applies these patterns merely to make checks pass, defects in WASM or non-`local_fs` configurations may no longer be exposed by tests or warnings.

These are active code-change recommendations. Gating a genuinely filesystem-dependent test is often legitimate, but the example skips it in every build where `local_fs` is disabled, not only WASM; `allow(dead_code)` also suppresses that diagnostic. The material does not require validating the scope or adding alternate coverage, so configuration-specific problems could be hidden. A user can ask for justification of each gate and documented coverage for non-`local_fs` and WASM paths.

SKILL.md:136In the instructionsOpen original file
**Gate tests behind `local_fs`:**```rust#[test]#[cfg(feature = "local_fs")]fn test_find_git_repo_with_worktree() {    // Test that uses filesystem operations}```
Show 2 other places
SKILL.md:145In the instructionsOpen original file
**Conditionally allow dead code for types only used when `local_fs` is enabled:**```rust#[cfg_attr(not(feature = "local_fs"), allow(dead_code))]#[derive(Clone, EnumDiscriminants, Serialize)]pub enum ExampleType {    // Variants only used when local_fs is enabled    Variant1,    Variant2,    Variant3,}```
SKILL.md:127In the instructionsOpen original file
WASM builds (`wasm32-unknown-unknown` target) don't support filesystem operations. Code that uses filesystem APIs must be gated behind the `local_fs` feature flag.**Common WASM errors:**- Dead code warnings for code only used in non-WASM builds- Unused code that's only relevant when `local_fs` is available- Tests that require filesystem access
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill targets the Warp Rust codebase and directs the agent to fix compilation, formatting, Clippy, WASM, and test problems, with presubmit checks before a PR.

View source
SKILL.md:8In the instructionsOpen original file
Fix compilation errors, linting issues, and test failures in the warp Rust codebase.
SKILL.md:19In the instructionsOpen original file
Before opening or updating a pull request, all presubmit checks must pass.

It runs a repository-local presubmit script plus Cargo lint, build, and test commands; the full test command covers most of the workspace by default.

View source
SKILL.md:23In the instructionsOpen original file
Run all presubmit checks at once:```bash./script/presubmit```
SKILL.md:56In the instructionsOpen original file
**All tests:**```bashcargo nextest run --no-fail-fast --workspace --exclude command-signatures-v2cargo nextest run -p warp_completer --features v2```

For WASM problems, the Skill recommends conditionally skipping filesystem-dependent tests behind `local_fs` and allowing dead-code warnings when that feature is disabled.

View source
SKILL.md:136In the instructionsOpen original file
**Gate tests behind `local_fs`:**```rust#[test]#[cfg(feature = "local_fs")]fn test_find_git_repo_with_worktree() {    // Test that uses filesystem operations}```
SKILL.md:145In the instructionsOpen original file
**Conditionally allow dead code for types only used when `local_fs` is enabled:**```rust#[cfg_attr(not(feature = "local_fs"), allow(dead_code))]#[derive(Clone, EnumDiscriminants, Serialize)]pub enum ExampleType {    // Variants only used when local_fs is enabled    Variant1,
Start here · InstructionsSKILL.md
fix-errors
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:25In the instructionsOpen original file
```bash./script/presubmit
SKILL.md:36In the instructionsOpen original file
**Rust formatting:**```bashcargo fmt -- --check
SKILL.md:41In the instructionsOpen original file
**Clippy (full workspace):**```bashcargo clippy --workspace --exclude warp_completer --all-targets --all-features --tests -- -D warnings
Lines read
181
File checksum (to compare versions)
be09b6351bf4b4cc5681b7783555ea7ec119403f58134f3a602cf6f0af22ce45