[aw] AW Optimization / Skills hit shell expansion guard rejection

### Workflow Failure

**Workflow:** [AW Optimization / Skills](https://github.com/githubnext/gh-aw-cao/blob/main/.github/workflows/optimization-skills-curator.md)
**Branch:** main
**Run:** https://github.com/githubnext/gh-aw-cao/actions/runs/34566144492

> [!WARNING]
> **Shell Expansion Guard Rejected Command**: The sandbox rejected a shell command because expansion patterns looked unsafe.

This signal was detected from engine runtime logs and is usually caused by retrying a multi-line shell command that embeds safe-output JSON or Markdown directly in the command text.

How to remediate

- Do **not** retry the identical rejected command.
- Put multi-line content in a temporary file with a single-quoted heredoc.
- Use `jq -Rs` to JSON-escape the file contents before piping to `safeoutputs`.

```bash
cat <<'EOF' > /tmp/gh-aw/body.md
Title

Multi-line body content goes here.
EOF
jq -Rs '{title: "My title", body: .}' /tmp/gh-aw/body.md | safeoutputs create_discussion .
```

### Action Required

**Assign this issue to an agent** to debug and fix the issue.

Debug with any coding agent

Use this prompt with any coding agent (GitHub Copilot, Claude, Gemini, etc.):

````
Debug the agentic workflow failure using https://raw.githubusercontent.com/github/gh-aw/main/debug.md

The failed workflow run is at https://github.com/githubnext/gh-aw-cao/actions/runs/34566144492
````

Manually invoke the agent

Debug this workflow failure using your favorite Agent CLI and the `agentic-workflows` prompt.

- Start your agent
- Load the `agentic-workflows` skill from `.github/skills/agentic-workflows/SKILL.md` or
- Type `debug the agentic workflow optimization-skills-curator failure in https://github.com/githubnext/gh-aw-cao/actions/runs/34566144492`

> [!TIP]
>
> Stop reporting this workflow as a failure
>
> To stop a workflow from creating failure issues, set `report-failure-as-issue: false` in its frontmatter:
> ```yaml
> safe-outputs:
> report-failure-as-issue: false
> ```
>
>

> Generated from [AW Optimization / Skills](https://github.com/githubnext/gh-aw-cao/actions/runs/34566144492) · copilot · 109.3 AIC · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-id%3A+optimization-skills-curator%22&type=issues)
> - [x] expires on Sep 18, 2026, 5:55 AM UTC

Start with .github/workflows/optimization-skills-curator.md and the linked workflow run logs, then read debug.md and .github/skills/agentic-workflows/SKILL.md. Trace the rejected multi-line command and determine the workflow or engine change required to avoid the shell expansion guard; done means the workflow completes without this rejection.

Written by the indexing model from the issue text.