📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/competitor-analysis/scripts/extract_vs_names.mjs

@@ -9,10 +9,31 @@
 // Output: newline-delimited JSON to stdout, one object per candidate:
 //   { "name": "serper", "hits": 3, "domain": "serper.dev", "example": "Tavily vs Serper..." }
 
+import sanitizeFilename from 'sanitize-filename';
 import { readdirSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { isAbsolute, join, relative, resolve } from 'path';
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 
 if (args.includes('--help') || args.includes('-h') || args.length === 0) {
   console.error(`Usage: node extract_vs_names.mjs <directory> [--prefix <prefix>] [--seed "<csv>"]
@@ -28,7 +49,7 @@ Options:
   process.exit(args.includes('--help') || args.includes('-h') ? 0 : 1);
 }
 
-const dir = args[0];
+const dir = safeCliPath(args[0]);
 const prefixIdx = args.indexOf('--prefix');
 const prefix = prefixIdx !== -1 && args[prefixIdx + 1] ? args[prefixIdx + 1] : 'competitor';
 const seedIdx = args.indexOf('--seed');