🔒 Fix Python code injection in idstack-learnings-search

[savvides]

🎯 What:
Fixed a Python code injection vulnerability in bin/idstack-learnings-search. Shell variables ($SOURCES, $TYPE, $KEYWORD, $LIMIT) were previously being directly interpolated into an inline Python string.

⚠️ Risk:
If an attacker could control any of the interpolated shell variables (e.g. through the command line arguments like --type or --keyword), they could break out of the string context and execute arbitrary Python code. This leads to Remote Code Execution (RCE) / Arbitrary Code Execution within the context of the script.

🛡️ Solution:
Modified the inline Python 3 script to accept these shell variables safely via sys.argv. The Bash variables are passed as arguments to the python3 -c invocation and are securely accessed by index within the Python script (sys.argv[1], etc.), completely removing the interpolation and code injection vector.

---

PR created automatically by Jules for task 3948449470950029937 started by @savvides

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request refactors the inline Python script in bin/idstack-learnings-search to use command-line arguments (sys.argv) instead of direct shell variable interpolation. Feedback was provided to handle potential ValueError exceptions when parsing the limit argument as an integer, ensuring the script does not crash on invalid or empty inputs.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If LIMIT is empty (e.g., if passed as --limit "") or contains a non-integer value, int(sys.argv[4]) will raise a ValueError, causing the Python script to crash and fall back to the grep/tail implementation (which may also fail or behave unexpectedly).

We should wrap the integer conversion in a try-except block to fall back to a safe default value (like 3).

try:
    limit = int(sys.argv[4])
except ValueError:
    limit = 3