nanobot: 2026-09-11 15:17:08

skills/note/scripts/note_capture.py

@@ -73,7 +73,9 @@ def _append_log(filename: str, body: str) -> None:
 def main() -> int:
     parser = argparse.ArgumentParser(description="Capture a raw note into notes/inbox/")
     parser.add_argument(
-        "--text", default=None, help="Raw input; if omitted, read from stdin"
+        "--file",
+        default=None,
+        help="Path to a file holding the raw input; if omitted, read from stdin",
     )
     parser.add_argument(
         "--channel", default=None, help="Origin channel (telegram/websocket/cli)"
@@ -83,7 +85,16 @@ def main() -> int:
     )
     args = parser.parse_args()
 
-    body = args.text if args.text is not None else sys.stdin.read()
+    # The text is never passed on the command line: the exec safety guard scans the
+    # raw command string and misreads prose as a filesystem path (see SKILL.md).
+    if args.file is None:
+        body = sys.stdin.read()
+    else:
+        source = Path(args.file)
+        if not source.is_file():
+            print(f"No such file: {args.file}", file=sys.stderr)
+            return 1
+        body = source.read_text(encoding="utf-8")
     body = body.strip()
     if not body:
         print("Nothing to capture (empty input).", file=sys.stderr)