Update Managed Files

[ChiaAutomation]

Note

Low Risk
CI-only post-processing and prompt wording for PR comments; no runtime app or auth changes.

Overview
Tightens how supply-chain malware Cursor output appears on Dependabot/Renovate PR comments.

The malware-review prompt now requires the model to start with a standalone bold line (**Verdict: benign** or **Verdict: malicious**), not plain Verdict: text. After the agent runs, inline Python normalizes the extracted malware text: it finds verdict mentions (including mid-sentence), keeps the last verdict value, strips duplicate verdict lines (and stray bold markers), and rewrites the section so the bold verdict is always first, then reasoning.

^{Reviewed by Cursor Bugbot for commit 9619573. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9619573. Configure here.}

[cursor]

Last verdict mention overrides real verdict

High Severity

format_malware_review_verdict treats every line-start Verdict: benign or Verdict: malicious as a declaration and keeps the last one. Reasoning that restates those labels, which the prompt asks for when the scanner disagrees, can overwrite the model's real first-line verdict and strip the surrounding sentence.

Additional Locations (1)

• .github/workflows/dependency-cursor-review.yml#L925-L933

 

^{Reviewed by Cursor Bugbot for commit 9619573. Configure here.}