clean_text removed zero-width, bidi, soft-hyphen and BOM characters,
but Unicode tag characters (U+E0000-E007F, which shadow ASCII one for
one) and runs of variation selectors (one byte each) went into the
cleaned text untouched. An instruction spelled in them renders as
nothing on the page or in the terminal and still reads as text to the
model, so the gate passed it as clean.
Both are now removed and counted. What a tag run or a selector run
spells is decoded into a new invisible_text finding, scanned like
hidden content (so instruction_like and hidden_urls see it), and
raises the verdict's warning. Emoji subdivision flags and a lone
variation selector are counted, not flagged. /apply's list of findings
to show gains the new one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every portal CLI turned HTML into text with a bare tag strip, so the
text inside comments, <style>/<script> blocks and hidden or
display:none elements came out as visible text. Unicode tag
characters, bidi controls and zero-width characters passed through
untouched, raw from the portal's JSON or decoded from numeric
entities. A listing could carry an instruction that renders as nothing
on the page but reads as text to the model.
Each CLI now runs HTML through visibleHtml, extending the helper
jobindex already used for one of its page shapes, and strips invisible
characters at the one function every output format reads. The
/add-portal contract names both, with linkedin-search as the copy
source.
Each CLI's tests/hidden-text.test.ts drives the real path (the CLI in
a fresh process, the command handler, or the normalizer the handler
calls) and fails on master.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
/apply and /rank state that postings are untrusted third-party data,
never instructions. Ten other specs that fetch or read such content did
not: /scrape ingested portal CLI output and WebSearch results with no
rule, /gmail-sync classified inbound email - the input anyone can send -
with none, and /setup Path A read the verbatim archived posting and
email-quoting outcome notes and wrote calibration into
04-job-evaluation.md, which every later /apply and /rank loads.
Each spec now points at the Trust boundary section of 09-web-research.md
instead of copying it. /gmail-sync gains Important Rule 10 (no link
fetched, no attachment opened, no reply, draft, label or forward), and
/setup Step A3 never copies archive wording into a skill file.
The new test derives the set of specs from the tools they call, so a
future fetching command without the rule fails CI. On master it lists
all ten.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
settings.json pre-approves verify_pdf.py with any arguments, and
--dump-text wrote the PDF's text layer to any path it was given,
creating missing parent directories and overwriting existing files.
Reproduced on master through the real CLI: a one-page PDF's text was
written to a new directory outside the repo with no prompt. The CLI now
writes only a .txt under the repo's cv/ or cover_letters/ (where
apply.md Step 5d puts it) and refuses a symlinked target.
Bash(pdftotext:*) is dropped for the same reason: Poppler writes to any
output path, and `pdftotext <file> -` prints any PDF on disk into the
session. verify_pdf.py already wraps it; the documented manual fallback
still works and now asks first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
settings.json pre-approves tools/*.py, every portal CLI and
salary_lookup.py by path, and the skills keep Edit/Write granted. In the
turn that reads a posting, an agent could rewrite one of those files and
then run it under its existing allow rule. SECURITY.md's guarantee that
an agent "cannot silently turn that into a wider grant" covered the files
that define permissions, not the files the permissions name.
Edit(tools/**), Edit(.agents/**) and Edit(salary_lookup.py) join the
required ask rules. CV, cover-letter and tracker writes are unaffected.
Check 4 now also refuses skill and command frontmatter `hooks` and
!`command` dynamic-context lines, both of which run at load with no
prompt; only settings.json hooks were checked. Check 5 refuses an agent
permissionMode that removes prompts, and agent hooks and mcpServers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ci): drop persisted checkout credentials and pass matrix.tool through env
All nine actions/checkout steps left the job token in .git/config for
every later step, including bun install and bun test in CLI code a pull
request brings (zizmor artipacked). Each now sets
persist-credentials: false; no step needed the stored credential.
cli-checks expanded ${{ matrix.tool }} - a directory name discover-clis
reads from the PR's tree - into its shell script (zizmor
template-injection). It now arrives through env.
upstream-watch.yml grants issues: write to its one job rather than the
whole workflow.
The new stdlib-only test reproduces zizmor's findings on master exactly
(9 artipacked, 1 template-injection at ci.yml:227) and passes here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* changelog: place the #658 entry under [Unreleased]
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
