{"slug": "scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo", "title": "Scanning 525 Skills and 153 Claude Code & Codex Logs for Prompt-Injection & Repo-Open Traps", "summary": "A developer built repotrap, a zero-dependency scanner that detects prompt-injection and repo-open traps in untrusted input fed to coding agents such as Claude Code and Codex CLI. Scanning 525 local skill markdown files, 16 workspace repos and 153 agent transcripts surfaced hidden Unicode characters, delimiter spoofing, curl-pipe-to-shell commands in skill files, and startup hooks in .claude and .vscode configs. The tool, published to npm as npx repotrap, also offers a gh-issue pre-scan mode and an emit-hook mode that generates a PostToolUse sanitizer hook for ~/.claude/settings.json.", "body_md": "The discussion on `r/ClaudeAI` (`1xozfcv`) about why 98% of the `16,060` open GitHub issues on `anthropics/claude-code` cannot simply be handed to autonomous triage agents hit on a real engineering problem: **untrusted input poisoning**.\n\nWhenever you point Claude Code or Codex CLI at an external GitHub issue (`gh issue view`), a cloned PR branch, or a third-party `SKILL.md` file, four classes of traps can hijack the agent:\n\n`.claude/settings.json` (`hooks`, `apiKeyHelper`, `statusLine`), `.mcp.json`, or `.vscode/tasks.json` (`\"runOn\": \"folderOpen\"`) inside a cloned repo that run commands on startup.` U+E0000` to `U+E007F`), bidirectional overrides (` U+202A` to `U+202E`), and standalone zero-width spaces (` U+200B`).`<system-reminder>` and `</tool_result>` delimiters`curl ... | bash` inside skill files).\nWhen I ran my first scanner script across `525` local skill markdown files, `16` workspace repos, and `153` local Claude Code and Codex CLI transcripts, three things broke:\n\n`1,526` native `type: \"attachment\"` `.jsonl` lines for `125` sessions because Claude Code writes its own internal system reminders as `type: \"api-request-*\"` records. Filtering out native attachment records (`RTR012`) isolated untrusted `tool_result` payloads (`RTR008`).` custom_tool_call_output` nested object payloads (`142` zero-width characters across `5` sessions)`function_call_output` (where `payload.output` is a string), Codex CLI's `String(payload.output)` call turned the tool output into `\"[object Object]\"` and missed `138` of the `U+200E` characters ingested across `15` tool outputs (`RTR011`).` U+200D` ZWJ vs standalone `RTR014`)` 1` in `notebook-guidance/SKILL.md`) until I separated Emoji Zero-Width Joiner sequences (`<Emoji> U+200D <Emoji>`) from standalone `2` in `signs-of-ai-writing.md`, `RTR007`) and `curl -fsSL https://composio.dev/install | bash` remote shell pipe in `composio-cli/SKILL.md` (`RTR005`).` repotrap`\nI published the zero-dependency scanner as `repotrap` (`npx repotrap`):\n\n```\nnpx repotrap\n```\n\nYou can also pre-scan a live GitHub issue or PR via the `gh-issue` option (`npx repotrap` with `gh-issue owner/repo#123`) before letting an agent read it, or run `emit-hook` mode to generate a deterministic `PostToolUse` sanitizer hook for `~/.claude/settings.json`.\n\n`curl | sh` skill pipes, and `.claude`/`.vscode` repo-open hooks. It cannot prove whether plain natural-language prose without structural markers or override phrases will sway a model.\nGitHub: [https://github.com/princejain756/repotrap](https://github.com/princejain756/repotrap)\n\nnpm: [https://www.npmjs.com/package/repotrap](https://www.npmjs.com/package/repotrap)", "url": "https://wpnews.pro/news/scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo", "canonical_source": "https://dev.to/princejain756/scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo-open-traps-165a", "published_at": "2026-11-06 08:41:54+00:00", "updated_at": "2026-11-06 08:53:02.224097+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["repotrap", "Claude Code", "Codex CLI", "GitHub", "npm", "Anthropic", "composio-cli", "princejain756"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo", "markdown": "https://wpnews.pro/news/scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo.md", "text": "https://wpnews.pro/news/scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo.txt", "jsonld": "https://wpnews.pro/news/scanning-525-skills-and-153-claude-code-codex-logs-for-prompt-injection-repo.jsonld"}}