mirror of
https://github.com/MadsLorentzen/ai-job-search.git
synced 2026-11-08 07:57:40 +00:00
MaverickHQandClaude Opus 5.5
9ca456318c
settings.json pre-approves tools/*.py, every portal CLI and salary_lookup.py by path, and the skills keep Edit/Write granted. In the turn that reads a posting, an agent could rewrite one of those files and then run it under its existing allow rule. SECURITY.md's guarantee that an agent "cannot silently turn that into a wider grant" covered the files that define permissions, not the files the permissions name. Edit(tools/**), Edit(.agents/**) and Edit(salary_lookup.py) join the required ask rules. CV, cover-letter and tracker writes are unaffected. Check 4 now also refuses skill and command frontmatter `hooks` and !`command` dynamic-context lines, both of which run at load with no prompt; only settings.json hooks were checked. Check 5 refuses an agent permissionMode that removes prompts, and agent hooks and mcpServers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
72 lines
2.3 KiB
JSON
72 lines
2.3 KiB
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Skill(job-application-assistant)",
|
|
"Bash(bun run .agents/skills/jobbank-search/cli/src/cli.ts:*)",
|
|
"Bash(bun run .agents/skills/jobdanmark-search/cli/src/cli.ts:*)",
|
|
"Bash(bun run .agents/skills/jobindex-search/cli/src/cli.ts:*)",
|
|
"Bash(bun run .agents/skills/jobnet-search/cli/src/cli.ts:*)",
|
|
"Bash(bun run .agents/skills/linkedin-search/cli/src/cli.ts:*)",
|
|
"Bash(bun run .agents/skills/freehire-search/cli/src/cli.ts:*)",
|
|
"Bash(python salary_lookup.py:*)",
|
|
"Bash(python3 salary_lookup.py:*)",
|
|
"Bash(python tools/rank_state.py:*)",
|
|
"Bash(python3 tools/rank_state.py:*)",
|
|
"Bash(python tools/job_key.py:*)",
|
|
"Bash(python3 tools/job_key.py:*)",
|
|
"Bash(python tools/scrape_state.py:*)",
|
|
"Bash(python3 tools/scrape_state.py:*)",
|
|
"Bash(python tools/verify_pdf.py:*)",
|
|
"Bash(python3 tools/verify_pdf.py:*)",
|
|
"Bash(python tools/verify_layout.py:*)",
|
|
"Bash(python3 tools/verify_layout.py:*)",
|
|
"Bash(pdftotext:*)",
|
|
"Bash(python tools/robots_check.py:*)",
|
|
"Bash(python3 tools/robots_check.py:*)",
|
|
"Bash(python tools/fetch_page.py:*)",
|
|
"Bash(python3 tools/fetch_page.py:*)",
|
|
"Bash(python tools/posting_guard.py:*)",
|
|
"Bash(python3 tools/posting_guard.py:*)"
|
|
],
|
|
"ask": [
|
|
"Edit(.claude/settings.json)",
|
|
"Edit(.claude/settings.local.json)",
|
|
"Edit(.claude/skills/*/SKILL.md)",
|
|
"Edit(.claude/commands/*.md)",
|
|
"Edit(.claude/agents/**)",
|
|
"Edit(.github/**)",
|
|
"Edit(tools/security_guards.py)",
|
|
"Edit(tools/**)",
|
|
"Edit(.agents/**)",
|
|
"Edit(salary_lookup.py)",
|
|
"Bash(git push:*)"
|
|
],
|
|
"deny": [
|
|
"Read(.env)",
|
|
"Read(.env.*)",
|
|
"Read(~/.ssh/**)",
|
|
"Read(~/.aws/**)",
|
|
"Read(~/.gnupg/**)",
|
|
"Bash(curl -d:*)",
|
|
"Bash(curl --data:*)",
|
|
"Bash(curl -F:*)",
|
|
"Bash(curl --form:*)",
|
|
"Bash(curl -T:*)",
|
|
"Bash(curl --upload-file:*)",
|
|
"Bash(curl -X POST:*)",
|
|
"Bash(curl -X PUT:*)",
|
|
"Bash(curl -XPOST:*)",
|
|
"Bash(curl --request POST:*)",
|
|
"Bash(wget --post-data:*)",
|
|
"Bash(wget --post-file:*)",
|
|
"Bash(wget --method=POST:*)",
|
|
"Bash(scp:*)",
|
|
"Bash(sftp:*)",
|
|
"Bash(ssh:*)",
|
|
"Bash(nc:*)",
|
|
"Bash(ncat:*)",
|
|
"Bash(netcat:*)"
|
|
]
|
|
}
|
|
}
|