Summary

A small security + privacy correctness fix, surfaced by an external "responsible disclosure" review of the design-shotgun skill. Five of six flagged items were working-as-intended with guards the report missed; two led to real hardening here.

Security — slug helper

• bin/gstack-slug now sanitizes its output to [a-zA-Z0-9._-] on every path, including values read from its on-disk cache. The compute/fallback paths already filtered, but a cached value was echoed into eval "$(gstack-slug)" unsanitized, so a tampered ~/.gstack/slug-cache file could inject shell. The filter now runs unconditionally before the value is emitted, and a poisoned cache is healed on the next write.

Privacy — telemetry

• The telemetry consent copy now states what actually happens: "No code or file paths. Your repo name is recorded locally only and stripped before any upload" (was "No code, file paths, or repo names").
• The telemetry preamble sanitizes the repo basename before building its local analytics JSON, so an unusual repo directory name can't malform the record (and can't leak a fragment past the regex stripper).

Repo identity (repo, _repo_slug, _branch) was already stripped before any remote upload; this PR keeps the behavior and locks it with a test.

Test Coverage

[~] bin/gstack-slug — re-sanitize cached SLUG before echo→eval  [★★★ test/gstack-slug-sanitize.test.ts]
[+] telemetry repo-identity egress (repo/_repo_slug/_branch)    [★★★ test/telemetry-repo-strip.test.ts]
[~] generate-preamble-bash.ts basename sanitize                 [covered-by-construction: tr -cd can't emit JSON-breaking chars]
[~] generate-telemetry-prompt.ts consent copy                   [string, not a code path — llm-judge ✓]

Both new tests verified RED when their fix is removed. Tests: +2 files.

Pre-Landing Review

No issues found. Meaningful surface is ~12 lines of sanitization logic; reviewed inline (no SQL, no LLM trust boundary, no auth). Security-positive.

Design Review

No frontend files changed — design review skipped.

Eval Results

• LLM-judge (diff-selected): 24 pass, 1 skip, 0 fail (21s). Validates the regenerated SKILL.md docs.
• E2E: skipped this run by maintainer decision. The diff touches the preamble resolvers (global touchfiles), so the selector flagged 135/173 E2E tests, but none assert on the telemetry consent copy or repo basename — the change is behaviorally neutral for skill execution. Free bun test suite (skill validation + gen-skill-docs quality + golden regression + both new invariant tests) passes: exit 0, 0 failures.

Adversarial Review

Claude + Codex, both: ship/land. Injection verified closed (newline payloads, self-heal, BRANCH path all checked); generated JSON well-formed; repo fields stripped before upload; bash -n clean. One low non-exploitable finding (a metachar-only cache yields an empty SLUG for the session, handled downstream by ${SLUG:-unknown}) — noted as a low-priority follow-up, not blocking.

Scope Drift

Scope Check: CLEAN. Intent: fix the disclosed issues. Delivered: exactly that + tests + generated-doc regen.

Plan Completion

All code + test items DONE (gstack-slug sanitize, telemetry copy + basename sanitize, both invariant/regression tests). One non-code item deferred: sending the reply to the external reviewers (a communication, not a code deliverable).

Verification Results

Skipped — CLI/skill repo, no dev server to drive.

TODOS

No TODO items completed in this PR.

Test plan

• Free suite bun test passes (exit 0, 0 failures), run on merged state
• LLM-judge evals pass (24/25, 1 diff-deselected)
• Both new tests proven to fail when their fix is reverted

🤖 Generated with Claude Code