# Scanning 525 Skills and 153 Claude Code & Codex Logs for Prompt-Injection & Repo-Open Traps > Source: > Published: 2026-11-06 08:41:54+00:00 The discussion on `r/ClaudeAI` (`1xozfcv`) about why 98% of the `16,060` open GitHub issues on `anthropics/claude-code` cannot simply be handed to autonomous triage agents hit on a real engineering problem: **untrusted input poisoning**. Whenever you point Claude Code or Codex CLI at an external GitHub issue (`gh issue view`), a cloned PR branch, or a third-party `SKILL.md` file, four classes of traps can hijack the agent: `.claude/settings.json` (`hooks`, `apiKeyHelper`, `statusLine`), `.mcp.json`, or `.vscode/tasks.json` (`"runOn": "folderOpen"`) inside a cloned repo that run commands on startup.` U+E0000` to `U+E007F`), bidirectional overrides (` U+202A` to `U+202E`), and standalone zero-width spaces (` U+200B`).`` and `` delimiters`curl ... | bash` inside skill files). When I ran my first scanner script across `525` local skill markdown files, `16` workspace repos, and `153` local Claude Code and Codex CLI transcripts, three things broke: `1,526` native `type: "attachment"` `.jsonl` lines for `125` sessions because Claude Code writes its own internal system reminders as `type: "api-request-*"` records. Filtering out native attachment records (`RTR012`) isolated untrusted `tool_result` payloads (`RTR008`).` custom_tool_call_output` nested object payloads (`142` zero-width characters across `5` sessions)`function_call_output` (where `payload.output` is a string), Codex CLI's `String(payload.output)` call turned the tool output into `"[object Object]"` and missed `138` of the `U+200E` characters ingested across `15` tool outputs (`RTR011`).` U+200D` ZWJ vs standalone `RTR014`)` 1` in `notebook-guidance/SKILL.md`) until I separated Emoji Zero-Width Joiner sequences (` U+200D `) from standalone `2` in `signs-of-ai-writing.md`, `RTR007`) and `curl -fsSL https://composio.dev/install | bash` remote shell pipe in `composio-cli/SKILL.md` (`RTR005`).` repotrap` I published the zero-dependency scanner as `repotrap` (`npx repotrap`): ``` npx repotrap ``` You can also pre-scan a live GitHub issue or PR via the `gh-issue` option (`npx repotrap` with `gh-issue owner/repo#123`) before letting an agent read it, or run `emit-hook` mode to generate a deterministic `PostToolUse` sanitizer hook for `~/.claude/settings.json`. `curl | sh` skill pipes, and `.claude`/`.vscode` repo-open hooks. It cannot prove whether plain natural-language prose without structural markers or override phrases will sway a model. GitHub: [https://github.com/princejain756/repotrap](https://github.com/princejain756/repotrap) npm: [https://www.npmjs.com/package/repotrap](https://www.npmjs.com/package/repotrap)