📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/competitor-analysis/scripts/list_urls.mjs

@@ -5,10 +5,31 @@
 // Reads all {prefix}_discovery_batch_*.json files, deduplicates by domain,
 // outputs one URL per line to stdout, stats to stderr.
 
+import sanitizeFilename from 'sanitize-filename';
 import { readdirSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { isAbsolute, join, relative, resolve } from 'path';
 
 const args = process.argv.slice(2);
+function sanitizePathSegments(pathValue) {
+  return String(pathValue ?? '').split(/[\\/]+/).filter(Boolean).map((segment) => {
+    const sanitized = sanitizeFilename(segment);
+    if (sanitized !== segment || !sanitized) {
+      throw new Error(`Unsafe path segment: ${segment}`);
+    }
+    return sanitized;
+  });
+}
+
+function safeCliPath(pathValue, baseDir = process.cwd()) {
+  const root = resolve(baseDir);
+  const target = resolve(root, ...sanitizePathSegments(pathValue));
+  const rel = relative(root, target);
+  if (rel.startsWith('..') || isAbsolute(rel)) {
+    throw new Error(`Path escapes allowed directory: ${pathValue}`);
+  }
+  return target;
+}
+
 
 if (args.includes('--help') || args.includes('-h') || args.length === 0) {
   console.error(`Usage: node list_urls.mjs <directory> [--prefix <prefix>]
@@ -26,7 +47,7 @@ Examples:
   process.exit(args.includes('--help') || args.includes('-h') ? 0 : 1);
 }
 
-const dir = args[0];
+const dir = safeCliPath(args[0]);
 const prefixIdx = args.indexOf('--prefix');
 const prefix = prefixIdx !== -1 && args[prefixIdx + 1] ? args[prefixIdx + 1] : 'competitor';