fix(security): heredoc-quote user task + mktemp for output

[sahrizvi]

The documented altimate-code invocation was:

altimate-code run "<user's task>" \
  --yolo --output /tmp/altimate-result.md --dir "$(pwd)"

Two security-adjacent issues raised on the altimate-codex-plugin PR #2 review — since this SKILL.md content is the source-of-truth cloned across four sibling plugins, fixing here first:

1. Shell injection (HIGH)

Substituting raw user text inside "..." leaves $(...) and backticks live. A task like refactor `whoami` and $(rm -rf ~) gets command-substituted by the shell before altimate-code ever runs, and --yolo removes the confirmation gate. Fix: here-doc the task into a variable, then pass the variable:

TASK="$(cat <<'ALTIMATE_TASK'
<user's task, verbatim>
ALTIMATE_TASK
)"
altimate-code run "$TASK" ...

2. Hardcoded shared output path (MAJOR)

/tmp/altimate-result.md is world-readable, shared across concurrent sessions, and can hold warehouse rows, lineage, or PII findings. Fix: umask 077; OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)", reuse the variable, delete after reading.

Files changed

• plugins/altimate-code/skills/altimate-code/SKILL.md — delegation skill body (both first-invocation + --continue follow-up blocks)
• plugins/altimate-code/commands/altimate.md — /altimate slash command

Verified with PyYAML that the frontmatter still parses cleanly and the description contains the exact trigger token altimate-code intact.

Same fix will land in data-engineering-skills (the wider SoT), altimate-codex-plugin (PR #2), and altimate-opencode-plugin (PR #3) in parallel.

[kilo-code-bot]

SUGGESTION: Move the Xs to the end of the mktemp template for consistent cross-platform behavior.

mktemp randomizes the trailing run of Xs in the template. Here .md follows the XXXXXX, so behavior is inconsistent: GNU coreutils expects trailing Xs and may reject this template (mktemp: too few X's in template 'altimate-result.XXXXXX.md'), while BSD/macOS mktemp -t treats the whole argument as a literal prefix and appends its own random suffix, leaving XXXXXX verbatim in the filename. The .md extension is cosmetic (the file is read and then deleted), so trailing Xs are both portable and simpler. The identical call recurs on line 55 — apply to both.

Suggested change

	OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"
	OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX)"

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

SUGGESTION: Move the Xs to the end of the mktemp template for consistent cross-platform behavior.

mktemp randomizes the trailing run of Xs in the template. Here .md follows the XXXXXX, so behavior is inconsistent: GNU coreutils expects trailing Xs and may reject this template (mktemp: too few X's in template 'altimate-result.XXXXXX.md'), while BSD/macOS mktemp -t treats the whole argument as a literal prefix and appends its own random suffix, leaving XXXXXX verbatim in the filename. The .md extension is cosmetic (the file is read and then deleted), so trailing Xs are both portable and simpler. The identical call recurs on line 88 — apply to both.

Suggested change

	OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"
	OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX)"

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Optional — address if convenient

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	2

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
plugins/altimate-code/commands/altimate.md	39	mktemp template has non-trailing XXXXXX; cross-platform behavior differs (GNU may reject it, BSD treats the whole arg as a literal prefix). Recurs at line 55.
plugins/altimate-code/skills/altimate-code/SKILL.md	59	Same non-trailing XXXXXX mktemp template. Recurs at line 88.

Files Reviewed (2 files)

• plugins/altimate-code/commands/altimate.md — 1 issue
• plugins/altimate-code/skills/altimate-code/SKILL.md — 1 issue

The here-doc + mktemp rewrite correctly closes the shell-injection vector (quoted delimiter prevents $(...) / backtick command substitution of the user's task) and replaces the world-readable shared /tmp/altimate-result.md with a private temp file. The findings below are portability/robustness suggestions only — the security intent of the PR is sound.

Fix these issues in Kilo Cloud

---

_{Reviewed by glm-5.2 · Input: 60.9K · Output: 37.5K · Cached: 445.5K}