From f4ad7e034df8efdd64aca01a92527e0dbd1fc05b Mon Sep 17 00:00:00 2001 From: Kevin McCarthy Date: Fri, 9 Oct 2026 16:06:52 -0400 Subject: [PATCH] fix: say why scripts are refused and how a person adds one in the admin --- README.md | 3 +++ docs/GUIDE.md | 31 +++++++++++++++++++++++++++++++ src/commands/footers.rs | 3 ++- src/commands/posts.rs | 1 + 4 files changed, 37 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 84d230b..7f5c2ae 100644 --- a/README.md +++ b/README.md @@ -342,6 +342,9 @@ Highlights: attributes and inline `` in content, so a designed page can be edited without losing them. Other scripts, event handlers and forms are still removed and reported as warnings; `geekcli guide html` has the rules. + JavaScript is refused on purpose, so that nothing an agent reads can talk + it into adding code to a site; a person adds a script in the site's admin + (the warning links to the form: click the editor's code button and paste). - **Drafts by default**: `posts create` sends `status: draft` unless you pass `--status published`. The API itself defaults to published, which is the wrong default for automation. diff --git a/docs/GUIDE.md b/docs/GUIDE.md index 1ef2a90..178d250 100644 --- a/docs/GUIDE.md +++ b/docs/GUIDE.md @@ -1117,6 +1117,37 @@ microdata attributes. **It drops** `script` (except JSON-LD, below), `number-of-tiles="three"` hook vanishes silently). Entities get normalised; that is not a change. +**Scripts are refused on purpose.** An agent reads web pages, listings +and other people's content while it works, and any of that text could +carry instructions meant for it (prompt injection). If the API saved +JavaScript, such text could get code running for every visitor to the +site. So `