docs(sable-d5d): audit + tighten rafter-skill-review skill (A15)#126
Merged
Conversation
Audit pass deferred from sable-bum / PR #122. Adds concrete mechanical checks for the realistic install-time risks of third-party SKILL.md, MCP manifest, Cursor rule, or agent config: - prompt-injection in the skill body - hidden tool invocations in install steps (curl|sh, npm postinstall) - exfiltration patterns (curl to attacker host, base64 phone-home) - overbroad allowed-tools grants - typo-squat / stale package names - skills that sabotage / disable peer skills - sensitive-path reads (~/.ssh, ~/.aws/credentials, keychain) - MCP manifests granting servers/tools silently SKILL.md changes: - new "Watch-items at a glance" table pairing each risk with a grep/jq/CLI check and the sub-doc that covers it - step 0 now points at `rafter scan injection` as a complementary mechanical pass alongside `rafter skill review` - canonical-command note clarifies `rafter agent audit-skill` is the deprecated alias (matches sable-bum edits to sibling rafter SKILL.md) - fast path is now a runnable three-step script - decision rule is now four items (adds the injection-scan gate) Sub-doc edits (additive, no restructure): - prompt-injection.md: new §0 mechanical-first-pass with `rafter scan injection` (cross-link to PR #118 / sable-h6r detector) - data-practices.md §5: explicit allowed-tools reconciliation check; calls out the "markdown formatter asking for Bash" red flag - authorship-provenance.md §4: concrete `npm view ... time.created` typo-squat command plus three in-the-wild examples - malware-indicators.md §6–7: consolidated grep commands for privileged writes and intelligence-gathering primitives Files: 5 Node + 5 Python mirror. `diff -rq` empty. Punted (future bead candidates): - supply-chain-risks.md sub-doc consolidating §4 (typo-squat) + changelog-review §6 (dependency drift) + malware §3 (postinstall) — currently scattered across three docs - agent-config-specific.md sub-doc for MCP manifest / Cursor rule / Continue rule schemas (currently MCP is one row in the table only) - post-install detection: this skill is pre-install only; a sibling "post-install audit" skill could cover installed-skill drift Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Maylist A15: pass through the rafter-skill-review skill and tighten its advice + mechanical checks.
Sable-bum (PR #122) intentionally deferred this skill to sable-d5d. This PR is that follow-up.
What changed
Audit + light edits to the rafter-skill-review skill (Node + Python parity verified, byte-identical).
SKILL.md grew (106 → 148) because the new "Watch-items at a glance" table is worth carrying in the main skill — it gives reviewers a single mechanical-check matrix instead of a hunt across 5 sub-docs. Still under the 150-line soft ceiling.
Edits applied
PR #118 (sable-h6r) cross-references added
Six places in the skill now point at `rafter scan injection` as the mechanical complement to the structured human-judgment review.
Punted (future bead candidates listed in the agent's report)
Parity
`diff -rq node/resources/skills/rafter-skill-review/ python/rafter_cli/resources/skills/rafter-skill-review/` returns empty.
Self-defense note
The agent deliberately did NOT embed literal zero-width / bidi characters in SKILL.md (those live in `docs/prompt-injection.md` §1 where they're documented). The shipped SKILL.md does not self-trigger `rafter scan injection`.
Target: `maylist`.
Closes sable-d5d.
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.7 noreply@anthropic.com