mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Alexei Fedotov
f38d125360
`gh auth status --show-token` prints the plaintext GitHub token, so the entry creates a silent credential-disclosure path under the prompt-suppressed allowlist.
35 lines
769 B
JSON
35 lines
769 B
JSON
{
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(gh pr view:*)",
|
|
"Bash(gh pr list:*)",
|
|
"Bash(gh pr checks:*)",
|
|
"Bash(gh pr diff:*)",
|
|
"Bash(gh pr status:*)",
|
|
"Bash(gh issue view:*)",
|
|
"Bash(gh issue list:*)",
|
|
"Bash(gh repo view:*)",
|
|
"Bash(gh search:*)",
|
|
"Bash(gh run view:*)",
|
|
"Bash(git log:*)",
|
|
"Bash(git show:*)",
|
|
"Bash(git status)",
|
|
"Bash(git rev-parse:*)",
|
|
"Bash(git remote -v)",
|
|
"Bash(ls:*)",
|
|
"Bash(cat:*)",
|
|
"Bash(head:*)",
|
|
"Bash(tail:*)",
|
|
"Bash(grep:*)",
|
|
"Bash(wc:*)",
|
|
"Bash(jq:*)",
|
|
"Bash(which:*)",
|
|
"Bash(strings:*)",
|
|
"Bash(nm:*)",
|
|
"Bash(pwd)",
|
|
"WebFetch(domain:github.com)",
|
|
"WebSearch(*)"
|
|
]
|
|
}
|
|
}
|