fix(security): heredoc-quote user task + mktemp for output

skills/altimate-code/SKILL.md

@@ -32,34 +32,52 @@ altimate-code has multiple agent personas. The default (`builder`) does a full p
 
 ### Step 2 — invoke with the chosen agent
 
+Pass the task through a here-doc into a variable so the shell never
+command-substitutes anything the user typed (a task like
+`refactor `whoami` and $(rm -rf ~)` would otherwise fire `whoami` and
+`rm -rf ~` before `altimate-code` ever runs). Write the result to a
+private temporary file, not a shared one under `/tmp`:
+
 ```bash
-altimate-code run "<user's task, verbatim>" \
+TASK="$(cat <<'ALTIMATE_TASK'
+<user's task, verbatim>
+ALTIMATE_TASK
+)"
+umask 077
+OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"
+altimate-code run "$TASK" \
   --agent <fast-edit|analyst|builder> \
   --yolo \
-  --output /tmp/altimate-result.md \
+  --output "$OUTPUT_FILE" \
   --dir "$(pwd)"
 ```
 
-Then `Read /tmp/altimate-result.md` and emit its contents to the user without re-summarising, re-formatting, or commenting on the result. altimate-code has already produced the answer.
+Then `Read "$OUTPUT_FILE"` and emit its contents to the user without re-summarising, re-formatting, or commenting on the result. altimate-code has already produced the answer. Delete `"$OUTPUT_FILE"` after presenting so warehouse rows, lineage, or PII findings don't linger on disk.
 
 ### Required flags
 
 | Flag | Why it is required |
 |---|---|
 | `--agent <name>` | Picks the agent persona. Default `builder` is overkill for simple edits — see the classification table above. Wrong agent = either 10× too expensive (using `builder` on a rename) or wrong-answer (using `fast-edit` on a multi-table join). |
 | `--yolo` | Non-interactive mode. Without this the subprocess hangs on the first permission prompt and you will time out. |
-| `--output /tmp/altimate-result.md` | Captures the final response. Without this you lose the answer to stdout-buffering and can't reliably read it back. |
+| `--output "$OUTPUT_FILE"` | Captures the final response. Use the private `mktemp` file from above — do NOT use a fixed path like `/tmp/altimate-result.md`; concurrent sessions clobber each other and a world-readable fixed path leaks data. |
 | `--dir "$(pwd)"` | Runs altimate-code in the current project so it picks up dbt project config, profiles.yml, etc. |
 
 ### Follow-up tasks in the same project
 
-When the user makes a follow-up data task in the same project after a successful altimate-code delegation, prefer `--continue` to resume the warm session instead of starting a fresh one:
+When the user makes a follow-up data task in the same project after a successful altimate-code delegation, prefer `--continue` to resume the warm session instead of starting a fresh one. Same here-doc + `mktemp` pattern:
 
 ```bash
-altimate-code run "<follow-up task>" \
+TASK="$(cat <<'ALTIMATE_TASK'
+<follow-up task>
+ALTIMATE_TASK
+)"
+umask 077
+OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"
+altimate-code run "$TASK" \
   --agent <fast-edit|analyst|builder> \
   --yolo \
-  --output /tmp/altimate-result.md \
+  --output "$OUTPUT_FILE" \
   --dir "$(pwd)" \
   --continue   # resumes the most recent session in this dir
 ```

skills/altimate-code/commands/altimate.md

@@ -25,27 +25,43 @@ Workflow (follow in order, no skipping):
 
    Decision rule: start with `fast-edit`. Only use `analyst` / `builder` when the cheap path fails for a documented reason.
 
-3. **Run altimate-code with the chosen agent:**
+3. **Run altimate-code with the chosen agent.** Pass `$ARGUMENTS` through a
+   here-doc into a variable so the shell never command-substitutes anything the
+   user typed, and write the result to a private `mktemp` file (not a shared
+   `/tmp/altimate-result.md` — concurrent invocations clobber each other and a
+   world-readable fixed path leaks warehouse rows or PII):
    ```bash
-   altimate-code run "$ARGUMENTS" \
+   TASK="$(cat <<'ALTIMATE_TASK'
+   $ARGUMENTS
+   ALTIMATE_TASK
+   )"
+   umask 077
+   OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"
+   altimate-code run "$TASK" \
      --agent <fast-edit|analyst|builder> \
      --yolo \
-     --output /tmp/altimate-result.md \
+     --output "$OUTPUT_FILE" \
      --dir "$(pwd)"
    ```
 
    **If this is a follow-up task in the same project** (the user invoked `/altimate` already in this conversation about the same dbt project / warehouse / data context), add `--continue` to resume the warm session — cache is hot, follow-on cost is materially lower:
 
    ```bash
-   altimate-code run "$ARGUMENTS" \
+   TASK="$(cat <<'ALTIMATE_TASK'
+   $ARGUMENTS
+   ALTIMATE_TASK
+   )"
+   umask 077
+   OUTPUT_FILE="$(mktemp -t altimate-result.XXXXXX.md)"
+   altimate-code run "$TASK" \
      --agent <fast-edit|analyst|builder> \
-     --yolo --output /tmp/altimate-result.md --dir "$(pwd)" \
+     --yolo --output "$OUTPUT_FILE" --dir "$(pwd)" \
      --continue
    ```
 
    Skip `--continue` if the user switched projects, switched debugging threads, or this is the first `/altimate` invocation in the conversation.
 
-4. **Surface the result verbatim:** read `/tmp/altimate-result.md` and present its contents to the user without re-summarising, re-formatting, or commenting. altimate-code has already produced the answer.
+4. **Surface the result verbatim:** read `"$OUTPUT_FILE"` and present its contents to the user without re-summarising, re-formatting, or commenting. altimate-code has already produced the answer. Delete `"$OUTPUT_FILE"` after presenting so warehouse rows, lineage, or PII findings don't linger on disk.
 
 5. **On any altimate-code error** (`Unauthorized`, `Token limit reached`, `No provider configured`, warehouse credentials wrong, process timeout) — surface the error message to the user along with the fix from the skill body's failure-modes table. Do NOT fall back to native tools. The user invoked `/altimate` specifically to use altimate-code; falling back would defeat the purpose.