mirror of https://github.com/garrytan/gstack.git
808ce0de8e
The sidebar system prompt pushes the agent to run \`\$B snapshot\` as its primary read path, but snapshot was NOT in PAGE_CONTENT_COMMANDS, so its ARIA-name output flowed to Claude unwrapped. A malicious page's aria-label attributes became direct agent input without the trust boundary markers that every other read path gets. Adding 'snapshot' to the set runs the output through wrapUntrustedContent() like text/html/links/forms already do. Caught by codex adversarial review. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bin | ||
| scripts | ||
| src | ||
| test | ||
| PLAN-snapshot-dropdown-interactive.md | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||