py/ai-job-search
1
0
Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-09-17 00:26:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): gitignore /upskill reports at the path the skill writes them (#317)

Browse Source 
The upskill/*.md rule is rooted, but /upskill is a skill and skills
resolve bare relative paths against their own directory - the same
observed behavior the **/job_scraper rules exist for. A report at
.claude/skills/upskill/upskill/report-*.md was not ignored, and an
upskill report records the candidate's skill gaps against named
employers. **/upskill/*.md would also ignore the skill's own SKILL.md
(the directory shares the name), so the new rule pins the report-file
prefix: **/upskill/report-*.md. Added to .gitignore and
REQUIRED_IGNORE_RULES, with a check-ignore-based test pinning both
properties.
This commit is contained in:
Ayobami Adegoke
2026-08-11 19:07:21 +02:00
committed by GitHub
parent 1ab6c78332
commit cfd9a9fba1
4 changed files with 68 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/security_guards.py
+7
View File
@@ -73,6 +73,13 @@ REQUIRED_IGNORE_RULES = [
"gmail_sync/",
"reports/",
"upskill/*.md",
# Depth-independent twin of the rule above. The upskill *skill* resolves
# `upskill/` relative to its own directory - the same observed behavior
# the **/job_scraper rules exist for - so reports can land at
# .claude/skills/upskill/upskill/*.md where the rooted rule cannot see
# them. `**/upskill/*.md` would also ignore the skill's own SKILL.md
# (the directory shares the name), so the report-file prefix is pinned.
"**/upskill/report-*.md",
# Not personal data but the same failure mode: /add-portal can generate a
# skill for a portal that only returns usable content through a paid
# fetching service, and that skill reads an API token from the environment.