claude-skills

mirror of https://github.com/alirezarezvani/claude-skills.git synced 2026-09-06 08:15:58 +00:00

History

Claude aac29fc486 fix(human-gate): G1 is unwaivable; drop inline style; render images Fourth PR-review round on #948. All four reproduced first. 1. The gate was one flag away from opt-out. --waive applied to whatever gate_refusals() returned, including G1 "no review round has been collected", so `close --waive "no time"` exited 0 with nobody having looked at the artifact. That is the most tempting shortcut for an agent under time pressure and it defeats the skill's whole premise. G1 is now unwaivable, with its own refusal message: a waiver accepts objections a reviewer raised, it cannot manufacture a review that never happened. Waiving a genuine objection (G2/G3/G4/G7) still works. 2. Inline `style` was unsanitized, so a reviewed draft containing `background-image:url(https://attacker/beacon.png)` fired a request the moment the reviewer opened the page — no script needed, and directly contrary to the no-network property the README and manifest advertise. Added to DROP_ATTRS. The <style> tag was already dropped, so keeping the attribute was inconsistent as well as leaky. 3. Markdown `![alt](url)` never rendered. LINK's regex was not anchored against a preceding `!`, so an image became `!<a href=...>` — and _safe_href's image=True branch, which exists to allowlist data:image URIs, was dead code on that path. Added an IMAGE regex ahead of LINK, negative-lookbehind on LINK, and real <img> rendering through the same scheme allowlist. Verified a javascript: src degrades to inert alt text. 4. An unterminated <script> silently swallowed the rest of the body — same confusing failure shape as the void-tag bug, though it fails safe. Now emits a named diagnostic to stderr instead of vanishing. Nit: raw-HTML `target="_blank"` anchors get the rel="noreferrer noopener" the Markdown path already added to its own. Re-verified: derive_counters --check, check_plugin_json --all, checklist 6/6 PASS, description validator PASS, all three scripts --help/--sample green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm	2026-08-09 06:21:17 +00:00
..
cs-human-gate.md	fix(human-gate): G1 is unwaivable; drop inline style; render images	2026-08-09 06:21:17 +00:00

fix(human-gate): G1 is unwaivable; drop inline style; render images

Fourth PR-review round on #948. All four reproduced first.

1. The gate was one flag away from opt-out. --waive applied to whatever
   gate_refusals() returned, including G1 "no review round has been collected",
   so `close --waive "no time"` exited 0 with nobody having looked at the
   artifact. That is the most tempting shortcut for an agent under time
   pressure and it defeats the skill's whole premise.

   G1 is now unwaivable, with its own refusal message: a waiver accepts
   objections a reviewer raised, it cannot manufacture a review that never
   happened. Waiving a genuine objection (G2/G3/G4/G7) still works.

2. Inline `style` was unsanitized, so a reviewed draft containing
   `background-image:url(https://attacker/beacon.png)` fired a request the
   moment the reviewer opened the page — no script needed, and directly
   contrary to the no-network property the README and manifest advertise.
   Added to DROP_ATTRS. The <style> tag was already dropped, so keeping the
   attribute was inconsistent as well as leaky.

3. Markdown `![alt](url)` never rendered. LINK's regex was not anchored against
   a preceding `!`, so an image became `!<a href=...>` — and _safe_href's
   image=True branch, which exists to allowlist data:image URIs, was dead code
   on that path. Added an IMAGE regex ahead of LINK, negative-lookbehind on
   LINK, and real <img> rendering through the same scheme allowlist. Verified a
   javascript: src degrades to inert alt text.

4. An unterminated <script> silently swallowed the rest of the body — same
   confusing failure shape as the void-tag bug, though it fails safe. Now emits
   a named diagnostic to stderr instead of vanishing.

Nit: raw-HTML `target="_blank"` anchors get the rel="noreferrer noopener" the
Markdown path already added to its own.

Re-verified: derive_counters --check, check_plugin_json --all, checklist 6/6
PASS, description validator PASS, all three scripts --help/--sample green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm

2026-08-09 06:21:17 +00:00

cs-human-gate.md

fix(human-gate): G1 is unwaivable; drop inline style; render images

2026-08-09 06:21:17 +00:00