The discussion on r/ClaudeAI (1xozfcv) about why 98% of the 16,060 open GitHub issues on anthropics/claude-code cannot simply be handed to autonomous triage agents hit on a real engineering problem: untrusted input poisoning.
Whenever you point Claude Code or Codex CLI at an external GitHub issue (gh issue view), a cloned PR branch, or a third-party SKILL.md file, four classes of traps can hijack the agent:
.claude/settings.json (hooks, apiKeyHelper, statusLine), .mcp.json, or .vscode/tasks.json ("runOn": "folderOpen") inside a cloned repo that run commands on startup. U+E0000 to U+E007F), bidirectional overrides ( U+202A to U+202E), and standalone zero-width spaces ( U+200B).<system-reminder> and </tool_result> delimiterscurl ... | bash inside skill files).
When I ran my first scanner script across 525 local skill markdown files, 16 workspace repos, and 153 local Claude Code and Codex CLI transcripts, three things broke:
1,526 native type: "attachment" .jsonl lines for 125 sessions because Claude Code writes its own internal system reminders as type: "api-request-*" records. Filtering out native attachment records (RTR012) isolated untrusted tool_result payloads (RTR008). custom_tool_call_output nested object payloads (142 zero-width characters across 5 sessions)function_call_output (where payload.output is a string), Codex CLI's String(payload.output) call turned the tool output into "[object Object]" and missed 138 of the U+200E characters ingested across 15 tool outputs (RTR011). U+200D ZWJ vs standalone RTR014) 1 in notebook-guidance/SKILL.md) until I separated Emoji Zero-Width Joiner sequences (<Emoji> U+200D <Emoji>) from standalone 2 in signs-of-ai-writing.md, RTR007) and curl -fsSL https://composio.dev/install | bash remote shell pipe in composio-cli/SKILL.md (RTR005). repotrap
I published the zero-dependency scanner as repotrap (npx repotrap):
npx repotrap
You can also pre-scan a live GitHub issue or PR via the gh-issue option (npx repotrap with gh-issue owner/repo#123) before letting an agent read it, or run emit-hook mode to generate a deterministic PostToolUse sanitizer hook for ~/.claude/settings.json.
curl | sh skill pipes, and .claude/.vscode repo-open hooks. It cannot prove whether plain natural-language prose without structural markers or override phrases will sway a model.
GitHub: https://github.com/princejain756/repotrap
npm: https://www.npmjs.com/package/repotrap