MaverickHQandClaude Opus 5.5 37e81a652c fix(specs): carry the untrusted-input rule into every spec that reads third-party content ...

/apply and /rank state that postings are untrusted third-party data,
never instructions. Ten other specs that fetch or read such content did
not: /scrape ingested portal CLI output and WebSearch results with no
rule, /gmail-sync classified inbound email - the input anyone can send -
with none, and /setup Path A read the verbatim archived posting and
email-quoting outcome notes and wrote calibration into
04-job-evaluation.md, which every later /apply and /rank loads.

Each spec now points at the Trust boundary section of 09-web-research.md
instead of copying it. /gmail-sync gains Important Rule 10 (no link
fetched, no attachment opened, no reply, draft, label or forward), and
/setup Step A3 never copies archive wording into a skill file.

The new test derives the set of specs from the tools they call, so a
future fetching command without the rule fails CI. On master it lists
all ten.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-27 16:07:33 +01:00

..

01-candidate-profile.md

Add a Language Gate - no dimension currently checks language requirements (#275)

2026-08-03 18:46:59 +02:00

02-behavioral-profile.md

feat(versioning): framework_version markers, CI version guard, and fork update checker (#144)

2026-07-14 14:29:24 +02:00

03-writing-style.md

fix(web-research): stop treating a WebFetch 403 as a dead posting (#277)

2026-08-04 20:36:55 +02:00

04-job-evaluation.md

fix(specs): settle every workflow spec on python3, one Windows note at first use (#678)

2026-10-20 08:27:21 +02:00

05-cv-templates.md

fix(specs): settle every workflow spec on python3, one Windows note at first use (#678)

2026-10-20 08:27:21 +02:00

06-cover-letter-templates.md

fix(latex): brace bracket-leading bullets, document escapes, pin pdftotext encoding

2026-08-19 19:44:36 +02:00

07-interview-prep.md

feat(versioning): framework_version markers, CI version guard, and fork update checker (#144)

2026-07-14 14:29:24 +02:00

08-application-forms.md

RFC feat(08): application-form fields as a third /apply artifact (#212)

2026-07-26 16:05:42 +02:00

09-web-research.md

fix(fetch-page): check robots policy before each redirect (#680)

2026-10-21 07:06:40 +02:00

SKILL.md

fix(specs): carry the untrusted-input rule into every spec that reads third-party content

2026-10-27 16:07:33 +01:00