Reported issues for oss-autopilot

Pod holds 24 of 79 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to oss-autopilot.

Most discussed

feat: configurable per-repo extraction categories (extend beyond Code Style / Process / Architecture / Testing / Other)

Summary

The extract-learnings MCP prompt produces a structured markdown document with five fixed categories: Code Style, Process, Architecture, Testing, Other. These five are baked into the prompt and produce uniform output across all repos.

This proposes making the category set extensible per repo — the user can declare additional or replacement categories for a specific repo, and the extraction prompt respects that taxonomy.

This is a real-but-bigger-scope change. The five defaults are

Read the thread · 2026-05-08 · closed · 1 comment

fix: pr-compliance-checker references nonexistent `read` MCP/CLI; bundle fix with extract-to-core, guidelines integration, repo PR template lookup, and CI gate against future drift

Summary

The pr-compliance-checker agent has two bugs and three improvements that share root causes. The bugs cause the agent to silently run on its slowest fallback code path. The improvements move it from "static scoring against generic best practices" to "scoring tuned to the target repo, using project data that already exists."

This is one issue because the fix surface overlaps. Resolving the broken read reference forces a touch on the agent's data-access layer, which is the same pla

Read the thread · 2026-05-07 · closed · 1 comment

umbrella: 10 medium-priority audit findings (M1–M10)

Summary

Umbrella for medium-priority findings from the 2026-04-28 audit. Each can be addressed in its own PR.

Checklist

M1: 412-conflict merge path is last-write-wins for state.json (`gist-state-store.ts:405-429`). After fetching the remote, the code re-applies all dirty cached files. Now that guidelines files are also dirty content, a concurrent maintainer update can be silently clobbered. Contradicts the optimistic-concurrency contract in `state.ts:256-264`. Fix: surface

Read the thread · 2026-05-04 · closed · 1 comment

Add upper bound cap on search maxResults

Problem

The search [count] CLI command validates that the count is a positive integer but imposes no upper bound (cli-registry.ts lines 121-127):

const parsed = Number(count);
if (!Number.isFinite(parsed) || parsed < 1 || !Number.isInteger(parsed)) {
  throw new Error(`Invalid count "${count}". Must be a positive integer.`);
}
maxResults = parsed;  // No ceiling check

A user or MCP tool can request maxResults=10000. While GitHub caps individual search results at

Read the thread · 2026-03-04 · closed · 1 comment

Pin npx version in .mcp.json to prevent supply chain risk

Problem

.mcp.json runs the MCP server via unpinned npx:

{
  "mcpServers": {
    "oss-autopilot": {
      "command": "npx",
      "args": ["@oss-autopilot/mcp"]
    }
  }
}

Without a version pin, npx resolves to the latest published version when the package isn't locally cached. If the npm package were compromised (credential theft, rogue release), users would silently execute malicious code.

Proposed Fix

Pin to the current version:

"args": ["@oss-autopilot

[Read the thread](https://github.com/costajohnt/oss-autopilot/issues/551) · 2026-03-04 · closed · 1 comment

### Remove silent auto-pull in session-start.sh

## Problem

`hooks/session-start.sh` runs an unattended `git pull --ff-only` against the remote repository on every Claude Code session start (lines 13-17):

```bash
MARKETPLACE_DIR="${HOME}/.claude/plugins/marketplaces/oss-autopilot"
if [ -d "${MARKETPLACE_DIR}/.git" ]; then
  (cd "${MARKETPLACE_DIR}" && git pull --ff-only) >/dev/null 2>&1 || true
fi

This silently fetches and executes new code from the remote without:

User confirmation
Integrity verification (no hash/signature check)

Read the thread · 2026-03-04 · closed · 1 comment

Add README.md for packages/mcp-server

Problem

@oss-autopilot/mcp is published to npm at v1.0.2, but the packages/mcp-server/ directory has no README.md. The npm package page is blank — this is a trust red flag for potential users evaluating the package.

The extensive MCP surface documentation exists in docs/plans/2026-02-28-mcp-server-design.md but is not surfaced in a user-facing README.

Expected

A packages/mcp-server/README.md that covers:

What the MCP server provides (21 tools, 5 resources, 3 prompts)
Inst

Read the thread · 2026-03-04 · closed · 1 comment

security: add SRI to CDN scripts and auth to MCP HTTP mode

Description

Two lower-severity security items:

1. External scripts without Subresource Integrity (Low)

File: `packages/core/src/commands/dashboard-templates.ts:22-27` Chart.js loaded from `cdn.jsdelivr.net` without `integrity` attribute. If the CDN is compromised, malicious JS could be injected. Fix: Add `integrity` and `crossorigin` attributes to the Chart.js script tag.

2. MCP HTTP server has no authentication (Medium)

File: `packages/mcp-server/src/index.t

Read the thread · 2026-03-04 · closed · 1 comment

Most recent

Encode maintainer-review conventions into the contribution workflow

Problem

The tool's PR-review-response workflow doesn't currently encode the maintainer-review patterns that repeatedly show up across contribution sessions. These are patterns an agent should apply automatically when drafting a fix or responding to review feedback, not something a human has to remember to paste into context each time.

Patterns to encode

Minimize public API surface. When fixing a reported bug, prefer fixing the behavior inside existing public APIs over adding new

Read the thread · 2026-07-11 · closed · 0 comments

Fence PR/issue titles and fork ref names on MCP prompt and resource surfaces

Severity: low (titles are short; but the MCP host LLM never sees the agents' injection-awareness blocks, so the agent-side mitigation does not apply on these surfaces)

Unfenced title paths where the consumer is an arbitrary MCP host LLM:

prompts.ts:76 (PR: ${data.pr.title} in respond-to-pr), :168 (### ${b.prTitle} in extract-learnings), :48 (triage injects JSON.stringify(digest) with raw openPRs[].title). Bodies in the same prompts ARE fenced.
resources.ts:108,175: fenceFetchedPR wraps