Skip to content

feat(permissions): allow osascript/kill/pkill/open for browser-extraction skill (Aaron 2026-05-12 authorization) #2805

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AceHack merged 1 commit into from
May 12, 2026
Merged

feat(permissions): allow osascript/kill/pkill/open for browser-extraction skill (Aaron 2026-05-12 authorization) #2805

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .claude/settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,10 @@
"Bash(z3 *)",
"Bash(node *)",
"Bash(mkdir *)",
"Bash(osascript *)",
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Narrow osascript permission to prevent shell-escape bypass

Allowing Bash(osascript *) grants unrestricted AppleScript execution, and on macOS AppleScript can invoke arbitrary shell commands (for example via do shell script), which bypasses the intended command allow-list model. This means any future skill invocation that reaches osascript can execute commands far outside browser extraction, so the permission is materially broader than the scoped intent stated in the commit.

Useful? React with 👍 / 👎.

"Bash(kill *)",
"Bash(pkill *)",
Comment on lines +79 to +80
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Limit kill/pkill patterns to browser-specific targets

The new Bash(kill *) / Bash(pkill *) entries permit terminating arbitrary local processes without further approval, not just Playwright/Chrome instances. In sessions where this config is active, an agent can accidentally or programmatically kill unrelated services (including long-running dev tools), creating avoidable instability; these should be constrained to the exact process names or scripted wrappers needed for browser extraction.

Useful? React with 👍 / 👎.

Comment on lines +79 to +80
"Bash(open -a *)",
Comment on lines +78 to +81
"Edit",
"Write",
"WebFetch",
Expand Down
Loading