Please use a private GitHub security advisory for the repository. If that is unavailable, contact the maintainer privately before public disclosure. Include the affected version, operating system, reproduction steps, expected impact, and whether a malicious repository is required.

Do not include real credentials, private instruction bodies, or unrelated repository data in a public issue.

Agent Instruction Stack Resolver performs local static analysis. It does not:

• execute an agent host or repository command;
• call an LLM or external service;
• make application-level network requests;
• load plugins or dynamic code from the scanned repository;
• send telemetry.

Repository analysis is read-only. The CLI writes only when the user explicitly supplies --output. Output is create-only: existing targets and symlink/reparse parent components are rejected, and the implementation uses a private temporary file plus an atomic no-overwrite link. Build, test, pack, and npm lifecycle commands naturally write their own local build or package artifacts.

The scanner uses built-in hard maxima for recursion depth, directories, files, directory entries, per-file bytes, aggregate source bytes, aggregate accounted bytes, diagnostics, and static analysis operations. Frontmatter bytes/lines/nodes/depth and baseline file/array/member sizes have separate limits. A limit or read diagnostic marks the scan incomplete and prevents snapshot creation.

The scanner rejects a symlink root, skips symlink/reparse entries, checks real-path containment, and rechecks file identity around reads. Settings references pass through a second containment- and budget-checked Markdown read. Detected identity changes fail closed.

Baseline input must be a bounded regular file; final-component symlinks and special files are rejected. Reads use no-follow semantics when available, with handle identity and size rechecks as the cross-platform fallback. Repository scanning and settings-reference loading separately enforce physical containment. Duplicate supported JSONC settings keys and duplicate file properties fail closed rather than inheriting ambiguous last-value behavior.

These controls narrow path traversal and TOCTOU risks but do not claim to eliminate every filesystem race on every platform. Avoid scanning a repository that an untrusted process can mutate concurrently.

Rendered reports omit raw instruction bodies and local absolute scan roots. They may still contain repository-relative paths, hashes, line counts, profile metadata, reason codes, and bounded path samples. These values can reveal repository structure and should be reviewed before publishing CI artifacts.

Snapshot fingerprints and revision hashes detect malformed or modified data. They are not signatures, do not authenticate who created a baseline, and should not be treated as a trust mechanism.

• Runtime dependencies are limited to YAML, JSONC, and minimatch parsing.
• Package installation uses no install hook.
• CI uses minimal permissions and immutable action commit references.
• Release validation includes dependency audit, packed-file allowlist checks, fresh-project installation with package scripts disabled, and likely-secret scanning.