3 people 69c1b3d88a fix(security): guard brain-sync arithmetic against injected .brain-last-pull; sanitize _GBRAIN_HOST ...

Re-derived from PR #2588 under the generated-file screening rule (resolver
hunks taken; SKILL.md files regenerated, not accepted). A poisoned
.brain-last-pull could reach bash arithmetic ($(( ))) — a code-execution
vector from a writable state file; the timestamp is now validated numeric
before use. _GBRAIN_HOST from ~/.claude.json is clamped to hostname-safe
characters before echo. Ship goldens refreshed to the regenerated output.

Co-authored-by: sneakygriff <89592870+sneakygriff@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-16 08:47:06 -07:00

..

SKILL.md

fix(security): guard brain-sync arithmetic against injected .brain-last-pull; sanitize _GBRAIN_HOST

2026-08-16 08:47:06 -07:00

SKILL.md.tmpl

community wave: 6 PRs + hardening (v0.18.1.0) (#1028)

2026-04-17 00:45:13 -07:00