+ lHjRt^RIt^RIt^RIHt]P !R4t.ROt]R,t Rt R] 2R3R] 2R 3R ] 2R 3R ] 2R 3R] R2R3.t Rt Rt RRltRRltRRltRRltRRltRRltR#) zCron prompt threat scanning: the small user-authored prompt gets the strict pattern set; the assembled prompt (with skill bodies) gets only prose-proof directives.N)INVISIBLE_CHARSztools.cronjob_tools:NNz:\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)\w*\}?z curl\s+[^\n]*https?://[^\s"\'`]*exfil_curl_urlz wget\s+[^\n]*https?://[^\s"\'`]*exfil_wget_urlzIcurl\s+[^\n]*(?:--data(?:-raw|-binary|-urlencode)?|-d|--form|-F)\s+[^\n]*exfil_curl_dataz(wget\s+[^\n]*--post-(?:data|file)=[^\n]*exfil_wget_postzHcurl\s+[^\n]*(?:-H|--header)\s+["\']Authorization:\s*(?:Bearer|token)\s+z["\']exfil_curl_auth_headeric<V^8dQhR\R\R\/#)textidxreturn)strintbool)formats">/home/ubuntu/.hermes/hermes-agent/tools/cronjob_prompt_scan.py __annotate__r;s!  3 S T caV^, pV^8d'\SV,4\8Xd V^,pK-V^,pV\S48d'\SV,4\8Xd V^, pK6V^8gV\S48dR#\;QJd V3RlW#34F 'dK R# R#!V3RlW#344#)zMTrue when the ZWJ at text[idx] sits between emoji codepoints (skipping VS16).Fc3<a"TFIo\;QJd$VV3Rl\4F 'gK RM RM!VV3Rl\44xKK R#5i)c3t<"TF-wrV\SS,4u;8*;'dV8*MuxK/ R#5i)N)ord).0lohiposr s& r 5_zwj_has_emoji_neighbour...Fs- P5O62B#d3i. & &B & &5Os58TFN)any_EMOJI_NEIGHBOUR_CP_RANGES)rrr s&@rr+_zwj_has_emoji_neighbour..Es6\iUX P5O P P5O PPP\isAA%AT)r_VARIATION_SELECTOR_CPlenall)r r leftrightsf& r_zwj_has_emoji_neighbourr';s 7D !)DJ+AA   !GE #d) DK 04J J   ax5CI% 3]a\i3333]a\i rc0V^8dQhR\R\/#r promptr r)rs"rrrJsrcb\P!R\ R2RV\PR7#)uScrub the bundled GitHub skill's `Authorization: token $GITHUB_TOKEN` + api.github.com curl so it doesn't trip the auth-header exfil rule. re.sub scrubs EVERY occurrence. The trailing ``[^\s;&|$`]*`` consumes only the URL path — never separators or subshell openers — so a payload smuggled onto the same line still gets scanned. Host must be exactly api.github.com followed by ``/``, whitespace, quote, or end: lookalike authorities (api.github.com.evil.com, api.github.com@evil.com) fall through. zBcurl\s+[^\n;&|$`]*(?:-H|--header)\s+["\']Authorization:\s*token\s+zJ["\']\s+["\']?https://api\.github\.com(?::\d+)?(?:/|\s|$|["\'])[^\s;&|$`]*z curl https://api.github.com/user)flags)resub_CRON_SECRET_VAR_RE IGNORECASE)r*s&r_strip_cron_safe_constructsr2Js8 66 MNaMbcQ Q*mm  rchV^8dQhR\R\\\\,3,/#r))rtuplelist)rs"rrr\s'--S-U3S >-B-rc:V'gV.3#\4p.p\V4FYwr4V\9d9VR8Xd\W4'g!VP R\ V4R 24KHVP V4K[ RPV4\V43#)zStrip invisible-unicode chars, keeping ZWJ inside legitimate emoji. Returns ``(cleaned, sorted U+XXXX labels removed)``. The skills-attached path sanitizes (a stray zero-width space in vetted skill content must not permanently kill the job). u‍U+04X) set enumerate_CRON_INVISIBLE_CHARSr'addrappendjoinsorted)r*removedcleanedr chs& r_strip_invisible_unicoderD\s rzGGV$ & &hC[\bChCh KK"SWSM* + r % 777 VG_ ,,rc0V^8dQhR\R\/#)r r r r+)rs"rrrnsscrcVFCpVF:wr4\P!W0\P4'gK2RV R2uu# KE R#)z(Blocked: prompt matches threat pattern 'zD'. Cron prompts must not contain injection or exfiltration payloads.r9)r.searchr1)r pattern_setspatternspatternpids&* r_first_pattern_errorrLnsK $LGyy 66>seDBB%! rc0V^8dQhR\R\/#r)r+)rs"rrrys e ec ec erc\V4p\\V4^,4p\F)pR\ V4R 2V9gKR\ V4R R2u# \ V\ \4#)zStrict scan of the USER-SUPPLIED prompt (create/update + runtime defense-in-depth). Returns an error string when blocked, else "". Invisible unicode is reported first, in ``_CRON_INVISIBLE_CHARS`` order (emoji ZWJ allowed).r7r8z-Blocked: prompt contains invisible unicode U+z (possible injection).)r2r:rDr<rrL_CRON_THREAT_PATTERNS_CRON_EXFIL_COMMAND_PATTERNS)r*prompt_to_scanrAchars& r_scan_cron_promptrSysk18N*>:1=>G% D # 7 *B3t9S/Qgh h& 0EGc ddrcRV^8dQhR\R\\\3,/#)r assembledr )rr4)rs"rrrs& o o# o%S/ orc\V4wrV'd0\PR\V4RP V44V\ \ V4\43#)uLoose scan of the ASSEMBLED prompt (skill content included). Invisible unicode is SANITIZED (stripped + logged), not blocked — the hard block stays on raw user prompts, the actual injection surface. Returns ``(cleaned_prompt, error)``, error "" when passed.zaCron skill-assembled prompt: stripped %d invisible-unicode char(s) (%s) from vetted skill contentz, )rDloggerwarningr#r?rLr2_CRON_SKILL_ASSEMBLED_PATTERNS)rUrBrAs& r_scan_cron_skill_assembledrZsS0 :G 5 L$))G, ()DW)MOmn nnr))zJignore\s+(?:\w+\s+)*(?:previous|all|above|prior)\s+(?:\w+\s+)*instructionsprompt_injection)zdo\s+not\s+tell\s+the\s+userdeception_hide)zsystem\s+prompt\s+overridesys_prompt_override)zrjsN K   0 1"7r!:S ))<(=>@PQ()<(=>@PQQReQfgiz{01D0EFHYZPQdPeejknFG  | $-$ e or