Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

create-task.sh templating: name/description text containing a frontmatter key substring corrupts the file

Abierto Apto para principiantes
  • ¿Algo no está bien?
#39 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
76/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python, shell
Área
backend, cli

Línea de trabajo

Comienza en agents/task-create/create-task.sh, alrededor de las líneas 495–510, e inspecciona el bloque de plantillas de Python y sus sustituciones. Comprueba cómo se insertan name y description en relación con las sustituciones de los campos de frontmatter; reprodúcelo con los ejemplos proporcionados owner:human o workflow_type:. Se considera terminado cuando se conserva el texto del autor de la llamada, se rellenan los campos obligatorios de frontmatter y el archivo de tarea supera la validación de su esquema.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Context

  • Framework version: 1.6.768
  • Project: 1409-sprind (shared-tooling mode)
  • Reported: 2026-09-21T12:06:04Z

Description

Symptom

agents/task-create/create-task.sh can silently write a schema-invalid task file (required fields blank) and silently corrupt the caller-supplied name/description text, with no error raised, when the name or description happens to contain certain substrings.

Root cause

Around line 495-510, the Python templating block runs a sequence of t.replace(old, new, 1) calls in this order:

t = t.replace('name:', 'name: "' + name... , 1)
t = t.replace('description: >', 'description: >\n' + indent_block(desc), 1)
t = t.replace('status: captured', 'status: ' + e['TC_STATUS'])
t = t.replace('workflow_type:', 'workflow_type: ' + e['TC_WORKFLOW_TYPE'], 1)
t = t.replace('owner:', 'owner: ' + e['TC_OWNER'], 1)
t = t.replace('horizon: now', 'horizon: ' + e['TC_HORIZON'])
t = t.replace('tags: []', 'tags: ' + e['TC_TAGS_YAML'])
t = t.replace('related_tasks: []', 'related_tasks: ' + e['TC_RELATED_YAML'])
...

The name and description are spliced into t first. The subsequent replace(..., 1) calls for workflow_type:, owner:, tags: [], related_tasks: [], horizon: now, created:, last_update: all match the first literal occurrence anywhere in t — not the frontmatter key specifically. Since t now contains the caller's free-text name/description before the real frontmatter lines further down, any of those literal substrings appearing inside the caller-supplied text is matched instead of the intended frontmatter line.

Reproduction (both observed in one session against a real fw task create call)

  1. --name containing the literal text owner:human (as a natural-language description of an ownership condition) → written file: the name: frontmatter field reads "...owner: agenthuman..." (the string agent was spliced into the middle of the caller's own text), and the real owner: frontmatter line was left blank (a required field).
  2. --description containing the literal text workflow_type: → written file: the description text is corrupted with workflow_type: build spliced in mid-sentence, and the real workflow_type: frontmatter line was left blank (a required field).

Both corrupted files passed task creation with no warning or error — the schema-required fields being blank went undetected until a later gate (fw bvp estimate, in this case) refused to operate on the task.

Why it matters

This is a data-integrity bug in the framework's own primary task-creation entrypoint: required fields can end up silently blank, and free-text content the caller explicitly wrote is silently mangled, with zero error signal. Any task whose subject matter is about frontmatter fields (which is common for meta/tooling tasks, audit findings about the task schema itself, etc.) is at risk of triggering this.

Suggested fix

Anchor each frontmatter-field replace to the actual frontmatter line rather than a bare substring — e.g. a re.sub(r'^workflow_type:$', ..., t, count=1, flags=re.MULTILINE) (matching the empty-value template line specifically) instead of str.replace('workflow_type:', ..., 1). Alternatively, perform all frontmatter-field substitutions before splicing in the caller-supplied name/description text, so free text can never be a match target.

Scope note

Filed from a downstream project using .agentic-framework/ in shared-tooling (vendored, read-only) mode.

Reported via fw upstream report from field installation

Lenguaje dominante
Shell
Estrellas
16
Forks
6
Merge medio
6 h 24 min
PR fusionados (30 d)
5

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de DimitriGeelen/agentic-engineering-framework

Todos los issues de DimitriGeelen/agentic-engineering-framework

Issues similares

Más issues de Shell/Bash

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.