Content Sanitization Guidelines When To Use Any skill or hook that loads content from external sources: - GitHub Issues, PRs, Discussions (via gh CLI) - WebFetch / WebSearch results - User-provided URLs - Any content not controlled by this repository When NOT To Use - Processing local, git-controlled files (trusted content) - Internal code analysis with no external input Trust Levels | Level | Source | Treatment | |---|---|---| | Trusted | Local files, git-controlled content | No sanitization | | Semi-trusted | GitHub content from repo collaborators | Light sanitization | | Untrusted | Web co…