/apply and /rank state that postings are untrusted third-party data,
never instructions. Ten other specs that fetch or read such content did
not: /scrape ingested portal CLI output and WebSearch results with no
rule, /gmail-sync classified inbound email - the input anyone can send -
with none, and /setup Path A read the verbatim archived posting and
email-quoting outcome notes and wrote calibration into
04-job-evaluation.md, which every later /apply and /rank loads.
Each spec now points at the Trust boundary section of 09-web-research.md
instead of copying it. /gmail-sync gains Important Rule 10 (no link
fetched, no attachment opened, no reply, draft, label or forward), and
/setup Step A3 never copies archive wording into a skill file.
The new test derives the set of specs from the tools they call, so a
future fetching command without the rule fails CI. On master it lists
all ten.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
settings.json pre-approves verify_pdf.py with any arguments, and
--dump-text wrote the PDF's text layer to any path it was given,
creating missing parent directories and overwriting existing files.
Reproduced on master through the real CLI: a one-page PDF's text was
written to a new directory outside the repo with no prompt. The CLI now
writes only a .txt under the repo's cv/ or cover_letters/ (where
apply.md Step 5d puts it) and refuses a symlinked target.
Bash(pdftotext:*) is dropped for the same reason: Poppler writes to any
output path, and `pdftotext <file> -` prints any PDF on disk into the
session. verify_pdf.py already wraps it; the documented manual fallback
still works and now asks first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
settings.json pre-approves tools/*.py, every portal CLI and
salary_lookup.py by path, and the skills keep Edit/Write granted. In the
turn that reads a posting, an agent could rewrite one of those files and
then run it under its existing allow rule. SECURITY.md's guarantee that
an agent "cannot silently turn that into a wider grant" covered the files
that define permissions, not the files the permissions name.
Edit(tools/**), Edit(.agents/**) and Edit(salary_lookup.py) join the
required ask rules. CV, cover-letter and tracker writes are unaffected.
Check 4 now also refuses skill and command frontmatter `hooks` and
!`command` dynamic-context lines, both of which run at load with no
prompt; only settings.json hooks were checked. Check 5 refuses an agent
permissionMode that removes prompts, and agent hooks and mcpServers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(ci): drop persisted checkout credentials and pass matrix.tool through env
All nine actions/checkout steps left the job token in .git/config for
every later step, including bun install and bun test in CLI code a pull
request brings (zizmor artipacked). Each now sets
persist-credentials: false; no step needed the stored credential.
cli-checks expanded ${{ matrix.tool }} - a directory name discover-clis
reads from the PR's tree - into its shell script (zizmor
template-injection). It now arrives through env.
upstream-watch.yml grants issues: write to its one job rather than the
whole workflow.
The new stdlib-only test reproduces zizmor's findings on master exactly
(9 artipacked, 1 template-injection at ci.yml:227) and passes here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* changelog: place the #658 entry under [Unreleased]
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
