Garry Tan 22ad3e5b64 fix: Codex filesystem boundary — prevent skill-file prompt injection (v0.12.10.0) (#570) ...

* fix: add filesystem boundary to all codex prompts

Codex CLI can read files outside the repo root despite -s read-only.
It discovers ~/.claude/skills/ and ~/.agents/skills/, treats SKILL.md
files as instructions, and executes preamble scripts instead of
reviewing code. Fix: prepend a boundary instruction to all 11 codex
exec/review callsites across codex/SKILL.md.tmpl (3), autoplan/
SKILL.md.tmpl (3), and scripts/resolvers/review.ts (5). Add rabbit-
hole detection rule and 5 regression tests.

* chore: bump version and changelog (v0.12.10.0)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-27 08:42:19 -06:00

..

SKILL.md

fix: Codex filesystem boundary — prevent skill-file prompt injection (v0.12.10.0) (#570)

2026-03-27 08:42:19 -06:00

SKILL.md.tmpl

fix: Codex filesystem boundary — prevent skill-file prompt injection (v0.12.10.0) (#570)

2026-03-27 08:42:19 -06:00