Stefan Andrei 886721d13a fix(security): guard brain-sync arithmetic against injected .brain-last-pull content; sanitize _GBRAIN_HOST ... The generated preamble bash fed the raw file content of ~/.gstack/.brain-last-pull into $(( )) — bash arithmetic evaluates array subscripts and command substitution, so a writable state file is an execution vector. It also interpolated the gbrain host string into the trusted status line unsanitized. Both are now normalized: .brain-last-pull content is reset to 0 unless purely numeric, and the host is clamped to a single line of hostname-safe characters. Regenerated all host outputs + re-blessed ship goldens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-08-15 23:47:03 +03:00
..
SKILL.md	fix(security): guard brain-sync arithmetic against injected .brain-last-pull content; sanitize _GBRAIN_HOST	2026-08-15 23:47:03 +03:00
SKILL.md.tmpl	v1.64.1.0 v1.64.1.0: the code-smell fix wave — every pipeline guard now provably fires (net −24,943 lines) (#2572)	2026-08-15 09:37:04 -07:00