Unverified50% confidenceSolutionExact time
Read operations pass through a path guard that rejects ../ escapes out of the checkout directory; search uses git grep -l -I -F with a cap of 20 file names.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
Unverified"Allow read_file" is not a valid policy; "only allow under /tmp/run-{id}/, and only allow the first twenty calls" is.61% similarUnverifiedArguments of commands judged to be read-only (such as rg or git grep) could still be shell-expanded into wildcards causing privilege escalation; this update causes these commands to trigger approval prompts again.59% similarUnverifiedIn /init files, prohibitive instructions make up 16.8% of all instructions, versus 21.2% in other files; in /init files, about one in every four instructions does not name a file, command or tool, while in other files it is close to one in every three.55% similarUnverifiedThe managed commit-msg hook executes each executable file under .githooks/commit-msg.d/ in filename order, and any non-zero exit rejects the commit, and oma never writes to that directory55% similarUnverifiedThe optimization ceiling for loading instructions by path only is 0.2%, and they are not loaded when the agent reads via the shell.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1048930API
curl https://kongchang.com/api/v1/knowledge/claims/1048930MCP
get_claim(id=1048930)