codex-plugin-cc/cancel.md at 80c31f99570876c3ef40327838b0a2ca1ae2cd9c

fix: quote \$ARGUMENTS in cancel, result, and status commands (#168 )

Unquoted \$ARGUMENTS in the ! shell commands allowed shell metacharacters
in user-supplied job IDs to be expanded before Node received them (e.g.,
`task-123; malicious-cmd` would execute the trailing command). This is
inconsistent with review.md and adversarial-review.md, which both wrap
"$ARGUMENTS" in double quotes.

Co-authored-by: claude[bot] <claude-bot@anthropic.com>
Co-authored-by: Claude Code <noreply@anthropic.com>

2026-04-08 14:48:50 -07:00

244 B

Raw Blame History

description	argument-hint	disable-model-invocation	allowed-tools
Cancel an active background Codex job in this repository	[job-id]	true	Bash(node:*)

!node "${CLAUDE_PLUGIN_ROOT}/scripts/codex-companion.mjs" cancel "$ARGUMENTS"

244 B Raw Blame History

244 B

Raw Blame History