Scanning 525 Skills and 153 Claude Code & Codex Logs for Prompt-Injection & Repo-Open Traps

A developer built repotrap, a zero-dependency scanner that detects prompt-injection and repo-open traps in untrusted input fed to coding agents such as Claude Code and Codex CLI. Scanning 525 local skill markdown files, 16 workspace repos and 153 agent transcripts surfaced hidden Unicode characters, delimiter spoofing, curl-pipe-to-shell commands in skill files, and startup hooks in .claude and .vscode configs. The tool, published to npm as npx repotrap, also offers a gh-issue pre-scan mode and an emit-hook mode that generates a PostToolUse sanitizer hook for ~/.claude/settings.json.

The discussion on r/ClaudeAI 1xozfcv about why 98% of the 16,060 open GitHub issues on anthropics/claude-code cannot simply be handed to autonomous triage agents hit on a real engineering problem: untrusted input poisoning . Whenever you point Claude Code or Codex CLI at an external GitHub issue gh issue view , a cloned PR branch, or a third-party SKILL.md file, four classes of traps can hijack the agent: .claude/settings.json hooks , apiKeyHelper , statusLine , .mcp.json , or .vscode/tasks.json "runOn": "folderOpen" inside a cloned repo that run commands on startup. U+E0000 to U+E007F , bidirectional overrides U+202A to U+202E , and standalone zero-width spaces U+200B . <system-reminder and </tool result delimiters curl ... | bash inside skill files . When I ran my first scanner script across 525 local skill markdown files, 16 workspace repos, and 153 local Claude Code and Codex CLI transcripts, three things broke: 1,526 native type: "attachment" .jsonl lines for 125 sessions because Claude Code writes its own internal system reminders as type: "api-request- " records. Filtering out native attachment records RTR012 isolated untrusted tool result payloads RTR008 . custom tool call output nested object payloads 142 zero-width characters across 5 sessions function call output where payload.output is a string , Codex CLI's String payload.output call turned the tool output into " object Object " and missed 138 of the U+200E characters ingested across 15 tool outputs RTR011 . U+200D ZWJ vs standalone RTR014 1 in notebook-guidance/SKILL.md until I separated Emoji Zero-Width Joiner sequences <Emoji U+200D <Emoji from standalone 2 in signs-of-ai-writing.md , RTR007 and curl -fsSL https://composio.dev/install | bash remote shell pipe in composio-cli/SKILL.md RTR005 . repotrap I published the zero-dependency scanner as repotrap npx repotrap : npx repotrap You can also pre-scan a live GitHub issue or PR via the gh-issue option npx repotrap with gh-issue owner/repo 123 before letting an agent read it, or run emit-hook mode to generate a deterministic PostToolUse sanitizer hook for ~/.claude/settings.json . curl | sh skill pipes, and .claude / .vscode repo-open hooks. It cannot prove whether plain natural-language prose without structural markers or override phrases will sway a model. GitHub: https://github.com/princejain756/repotrap https://github.com/princejain756/repotrap npm: https://www.npmjs.com/package/repotrap https://www.npmjs.com/package/repotrap