mirror of https://github.com/garrytan/gstack.git
886721d13a
The generated preamble bash fed the raw file content of ~/.gstack/.brain-last-pull into $(( )) — bash arithmetic evaluates array subscripts and command substitution, so a writable state file is an execution vector. It also interpolated the gbrain host string into the trusted status line unsanitized. Both are now normalized: .brain-last-pull content is reset to 0 unless purely numeric, and the host is clamped to a single line of hostname-safe characters. Regenerated all host outputs + re-blessed ship goldens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| vendor | ||
| SKILL.md | ||
| SKILL.md.tmpl | ||