py/ai-job-search
1
0
Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-09-17 00:26:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: narrow Bash(bun run:*) to the six shipped portal CLIs (#396)

Browse Source 
The upstream template pre-approves `Bash(bun run:*)`, which auto-approves
`bun run <any file>` — arbitrary TypeScript from anywhere on disk — on every
fork. Each portal SKILL.md already declares the tight form in its own
allowed-tools; this makes settings.json agree with them.

Blast radius drops from "any file on the machine" to the repo's own CLIs,
with no new prompts in the /scrape path. tools/security_guards.py's
ALLOWED_PERMISSIONS is updated in the same commit, as its docstring requires.

Local: security_guards OK, lint_skills OK, 318 tests pass.

Claude-Session: https://claude.ai/code/session_01HHqEAQqGS2KKXASiYcrAHQ
This commit is contained in:
Prasanth Kotaru
2026-08-30 20:27:31 +02:00
committed by GitHub
parent ea2f25b39c
commit 2d636c50bf
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/security_guards.py
+11 -1
View File
@@ -38,7 +38,17 @@ errors: list[str] = []
# an entry must add it here too - that is the point: the diff shows both.
ALLOWED_PERMISSIONS = {
"Skill(job-application-assistant)",
"Bash(bun run:*)",
# Narrowed from the upstream template's blanket Bash(bun run:*), which
# pre-approved `bun run <any file>`. One entry per shipped portal CLI,
# matching what each SKILL.md already declares in its allowed-tools.
# A portal added by /add-portal needs its own entry here and in
# .claude/settings.json - that review step is the point.
"Bash(bun run .agents/skills/jobbank-search/cli/src/cli.ts:*)",
"Bash(bun run .agents/skills/jobdanmark-search/cli/src/cli.ts:*)",
"Bash(bun run .agents/skills/jobindex-search/cli/src/cli.ts:*)",
"Bash(bun run .agents/skills/jobnet-search/cli/src/cli.ts:*)",
"Bash(bun run .agents/skills/linkedin-search/cli/src/cli.ts:*)",
"Bash(bun run .agents/skills/freehire-search/cli/src/cli.ts:*)",
"Bash(python salary_lookup.py:*)",
"Bash(python3 salary_lookup.py:*)",
"Bash(python tools/verify_pdf.py:*)",