mirror of
https://github.com/anthropics/claude-plugins-official.git
synced 2026-03-20 23:43:07 +00:00
1636fedbd4
- safeName() strips <>[]\r\n; from file_name/title before they hit the <channel> notification — delimiter chars would let an uploader break out of the tag or forge meta entries - download_attachment strips ext/uniqueId to alphanumeric before join() — defense-in-depth against path traversal (file_unique_id is Telegram-controlled so this is belt-and-braces)