📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/competitor-analysis/scripts/capture_screenshots.mjs

@@ -12,12 +12,33 @@
 //
 // Usage: node capture_screenshots.mjs <research-dir> [--mode remote|local] [--concurrency 2]
 
+import sanitizeFilename from 'sanitize-filename';
 import { readdirSync, readFileSync, mkdirSync, existsSync } from 'fs';
-import { join } from 'path';
+import { isAbsolute, join, relative, resolve } from 'path';
 import { spawnSync } from 'child_process';
 import { parseFrontmatter } from './md_utils.mjs';
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 
 if (args.includes('--help') || args.includes('-h') || args.length === 0) {
   console.error(`Usage: node capture_screenshots.mjs <research-dir> [options]
@@ -38,7 +59,7 @@ Options:
   process.exit(args.includes('--help') || args.includes('-h') ? 0 : 1);
 }
 
-const dir = args[0];
+const dir = safeCliPath(args[0]);
 const modeIdx = args.indexOf('--mode');
 const browseMode = modeIdx !== -1 ? args[modeIdx + 1] : 'remote';
 const modeFlag = browseMode === 'local' ? '--local' : '--remote';
@@ -63,7 +84,7 @@ if (concurrency > 1) {
   concurrency = 1;
 }
 
-const shotsDir = join(dir, 'screenshots');
+const shotsDir = safeCliPath('screenshots', dir);
 mkdirSync(shotsDir, { recursive: true });
 
 function run(cmd, args, { timeout = 30000 } = {}) {

antigravity-awesome-skills/skills/competitor-analysis/scripts/compile_report.mjs

@@ -9,6 +9,7 @@
 import { readdirSync, readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
 import { basename, dirname, join, relative, resolve } from 'path';
 import { fileURLToPath } from 'url';
+import sanitizeFilename from 'sanitize-filename';
 import { parseFrontmatter, parseBody, parseSections } from './md_utils.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -17,9 +18,19 @@ const __dirname = dirname(__filename);
 const args = process.argv.slice(2);
 const SAFE_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
 function safeJoin(base, ...parts) {
   const root = resolve(base);
-  const target = resolve(root, ...parts);
+  const target = resolve(root, ...parts.flatMap(sanitizePathSegments));
   const rel = relative(root, target);
   if (rel.startsWith('..') || rel.startsWith('/')) {
     throw new Error(`Path escapes research directory: ${parts.join('/')}`);
@@ -32,7 +43,7 @@ function safeResearchDir(rawDir) {
     throw new Error('Research directory is required');
   }
   const root = resolve(process.cwd());
-  const target = resolve(root, rawDir);
+  const target = safeJoin(root, rawDir);
   const rel = relative(root, target);
   if ((rel.startsWith('..') || rel.startsWith('/')) && process.env.COMPETITOR_ANALYSIS_ALLOW_EXTERNAL_DIR !== '1') {
     throw new Error('Research directory must stay under the current working directory');

antigravity-awesome-skills/skills/competitor-analysis/scripts/extract_vs_names.mjs

@@ -9,10 +9,31 @@
 // Output: newline-delimited JSON to stdout, one object per candidate:
 //   { "name": "serper", "hits": 3, "domain": "serper.dev", "example": "Tavily vs Serper..." }
 
+import sanitizeFilename from 'sanitize-filename';
 import { readdirSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { isAbsolute, join, relative, resolve } from 'path';
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 
 if (args.includes('--help') || args.includes('-h') || args.length === 0) {
   console.error(`Usage: node extract_vs_names.mjs <directory> [--prefix <prefix>] [--seed "<csv>"]
@@ -28,7 +49,7 @@ Options:
   process.exit(args.includes('--help') || args.includes('-h') ? 0 : 1);
 }
 
-const dir = args[0];
+const dir = safeCliPath(args[0]);
 const prefixIdx = args.indexOf('--prefix');
 const prefix = prefixIdx !== -1 && args[prefixIdx + 1] ? args[prefixIdx + 1] : 'competitor';
 const seedIdx = args.indexOf('--seed');

antigravity-awesome-skills/skills/competitor-analysis/scripts/gate_candidates.mjs

@@ -14,6 +14,7 @@
 //   { "url": "https://foo.com", "status": "PASS" | "REJECT" | "UNKNOWN",
 //     "matched_includes": [...], "matched_excludes": [...], "title": "...", "hero": "..." }
 
+import sanitizeFilename from 'sanitize-filename';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { readFileSync } from 'fs';
@@ -25,6 +26,26 @@ import { readFileSync } from 'fs';
 const execFileAsync = promisify(execFile);
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 
 if (args.includes('--help') || args.includes('-h')) {
   console.error(`Usage: cat urls.txt | node gate_candidates.mjs [options]

antigravity-awesome-skills/skills/competitor-analysis/scripts/list_urls.mjs

@@ -5,10 +5,31 @@
 // Reads all {prefix}_discovery_batch_*.json files, deduplicates by domain,
 // outputs one URL per line to stdout, stats to stderr.
 
+import sanitizeFilename from 'sanitize-filename';
 import { readdirSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { isAbsolute, join, relative, resolve } from 'path';
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 
 if (args.includes('--help') || args.includes('-h') || args.length === 0) {
   console.error(`Usage: node list_urls.mjs <directory> [--prefix <prefix>]
@@ -26,7 +47,7 @@ Examples:
   process.exit(args.includes('--help') || args.includes('-h') ? 0 : 1);
 }
 
-const dir = args[0];
+const dir = safeCliPath(args[0]);
 const prefixIdx = args.indexOf('--prefix');
 const prefix = prefixIdx !== -1 && args[prefixIdx + 1] ? args[prefixIdx + 1] : 'competitor';
 

antigravity-awesome-skills/skills/competitor-analysis/scripts/merge_partials.mjs

@@ -18,11 +18,32 @@
 //
 // Usage: node merge_partials.mjs <research-dir>
 
+import sanitizeFilename from 'sanitize-filename';
 import { readdirSync, readFileSync, writeFileSync, mkdirSync } from 'fs';
-import { join } from 'path';
+import { isAbsolute, join, relative, resolve } from 'path';
 import { parseFrontmatter, parseBody, parseSections } from './md_utils.mjs';
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 if (args.includes('--help') || args.includes('-h') || args.length === 0) {
   console.error(`Usage: node merge_partials.mjs <research-dir>
 
@@ -31,8 +52,8 @@ Reads {dir}/partials/{slug}.{lane}.md files and writes consolidated
   process.exit(args.includes('--help') || args.includes('-h') ? 0 : 1);
 }
 
-const dir = args[0];
-const partialsDir = join(dir, 'partials');
+const dir = safeCliPath(args[0]);
+const partialsDir = safeCliPath('partials', dir);
 
 const LANES = ['marketing', 'discussion', 'social', 'news', 'technical', 'battle'];