fix: address Copilot review findings from PR github#2401

- SSRF protection: reject private/loopback/reserved IPs and non-HTTP(S)
  schemes in check_url_reachable() before making network requests
- Table generator: exit non-zero when --target is set but markers are
  missing, so CI fails loudly instead of silently skipping the update
- Add catalog-table-start/end markers to docs/community/presets.md so
  the table generator can update it automatically
- Use RELEASE_PAT instead of GITHUB_TOKEN in catalog-pr.yml so
  auto-generated PRs trigger downstream CI workflows
- Reword extension safety FAQ to distinguish verified vs unverified
  community extensions

Author: mnriem

.github/scripts/catalog-generate-table.py

@@ -181,11 +181,11 @@ def main() -> None:
             print(f"Updated {target}")
         else:
             print(
-                f"Warning: markers {START_MARKER} / {END_MARKER} not found "
-                f"in {target}. Printing table to stdout.",
+                f"Error: markers {START_MARKER} / {END_MARKER} not found "
+                f"in {target}.",
                 file=sys.stderr,
             )
-            print(table)
+            sys.exit(1)
     else:
         print(table)
 

.github/scripts/catalog-validate.py

@@ -19,9 +19,11 @@
 from __future__ import annotations
 
 import argparse
+import ipaddress
 import json
 import os
 import re
+import socket
 import sys
 import urllib.error
 import urllib.parse
@@ -240,8 +242,27 @@ def check_url_reachable(
     if not _present(url):
         return True, ""  # skip if empty/optional
     url = url.strip()
+
+    # --- SSRF guard: reject non-HTTPS, private/loopback IPs ---
+    parsed = urllib.parse.urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        return False, f"{field_name} URL must use http or https scheme."
+    hostname = parsed.hostname
+    if not hostname:
+        return False, f"{field_name} URL has no hostname."
+    try:
+        addr_info = socket.getaddrinfo(hostname, None)
+        for _family, _type, _proto, _canonname, sockaddr in addr_info:
+            ip = ipaddress.ip_address(sockaddr[0])
+            if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
+                return False, (
+                    f"{field_name} URL `{url}` resolves to a private/reserved address."
+                )
+    except (socket.gaierror, ValueError):
+        pass  # DNS resolution may fail for unreachable hosts — let urlopen handle it
+
     _gh_hosts = {"github.com", "www.github.com", "codeload.github.com", "raw.githubusercontent.com"}
-    _is_github = urllib.parse.urlparse(url).hostname in _gh_hosts
+    _is_github = hostname in _gh_hosts
     req = urllib.request.Request(url, method="HEAD")
     req.add_header("User-Agent", "spec-kit-catalog-validator/1.0")
     if token and _is_github:

.github/workflows/catalog-pr.yml

@@ -20,6 +20,8 @@ jobs:
       issues: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.RELEASE_PAT }}
 
       - uses: actions/setup-python@v5
         with:
@@ -45,7 +47,7 @@ jobs:
       - name: Create or update pull request
         if: steps.update.outputs.skipped != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_AUTHOR: ${{ github.event.issue.user.login }}
           ITEM_ID: ${{ steps.update.outputs.item_id }}
@@ -136,6 +138,8 @@ jobs:
       issues: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.RELEASE_PAT }}
 
       - uses: actions/setup-python@v5
         with:
@@ -162,7 +166,7 @@ jobs:
       - name: Create or update pull request
         if: steps.update.outputs.skipped != 'true'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_AUTHOR: ${{ github.event.issue.user.login }}
           ITEM_ID: ${{ steps.update.outputs.item_id }}

docs/community/presets.md

@@ -5,6 +5,7 @@
 
 The following community-contributed presets customize how Spec Kit behaves — overriding templates, commands, and terminology without changing any tooling. Presets are available in [`catalog.community.json`](https://github.com/github/spec-kit/blob/main/presets/catalog.community.json):
 
+<!-- catalog-table-start -->
 | Preset | Purpose | Provides | Requires | URL |
 |--------|---------|----------|----------|-----|
 | AIDE In-Place Migration | Adapts the AIDE extension workflow for in-place technology migrations (X → Y pattern) — adds migration objectives, verification gates, knowledge documents, and behavioral equivalence criteria | 2 templates, 8 commands | AIDE extension | [spec-kit-presets](https://github.com/mnriem/spec-kit-presets) |
@@ -18,5 +19,6 @@ The following community-contributed presets customize how Spec Kit behaves — o
 | Screenwriting | Spec-Driven Development for screenwriting/scriptwriting/tutorials: feature films, television (pilot, episode, limited series), and stage plays. Adapts the Spec Kit workflow to screenplay craft — slug lines, action lines, act breaks, beat sheets, and industry-standard pitch documents. Supports three-act, Save the Cat, TV pilot, network episode, cable/streaming episode, and stage-play structural frameworks. Export to Fountain, FTX, PDF | 26 templates, 32 commands, 1 script | — | [speckit-preset-screenwriting](https://github.com/adaumann/speckit-preset-screenwriting) |
 | Table of Contents Navigation | Adds a navigable Table of Contents to generated spec.md, plan.md, and tasks.md documents | 3 templates, 3 commands | — | [spec-kit-preset-toc-navigation](https://github.com/Quratulain-bilal/spec-kit-preset-toc-navigation) |
 | VS Code Ask Questions | Enhances the clarify command to use `vscode/askQuestions` for batched interactive questioning. | 1 command | — | [spec-kit-presets](https://github.com/fdcastel/spec-kit-presets) |
+<!-- catalog-table-end -->
 
 To build and publish your own preset, see the [Presets Publishing Guide](https://github.com/github/spec-kit/blob/main/presets/PUBLISHING.md).

extensions/EXTENSION-USER-GUIDE.md

@@ -984,7 +984,7 @@ After creating tasks, sync to Jira:
 
 ### Q: How do I know if an extension is safe?
 
-**A**: Community extensions are **not** reviewed, audited, or tested by maintainers — only their catalog metadata is validated. Always review extension source code before installing.
+**A**: Spec Kit supports both **verified** extensions and unverified community extensions. Verified extensions are reviewed and approved according to project policy, and are identified in the catalog/CLI with the verified flag, `--verified` filter, or "✓ Verified" badge. Unverified community extensions have only their catalog metadata validated; they are not reviewed, audited, or tested by maintainers. Always review extension source code before installing an unverified extension.
 
 ### Q: Can extensions modify spec-kit core?