GHSA-62f5-cp2p-vq95: CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CodeWhale has a security vulnerability where a malicious `.codewhale/config.toml` file in a repository can read arbitrary files from a user's computer (like SSH keys or AWS credentials) by listing them in the `instructions` field, and then inject their contents into the AI model's system prompt (the instructions the AI receives). This happens because the code doesn't validate file paths or check if they're outside the project folder before reading them.