Repository navigation
feat: portability and safety guards (v0.9.0) - #22
Merged
Merged
Conversation
The candidate list tried python3 and python only. On a Windows install both resolve to the Microsoft Store stubs that pass `command -v` and then exit 49, which the file's own comment already described. The real interpreter there is the `py` launcher, so the suite was unrunnable on the Git Bash setup the README tells Windows users to install. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The README tells people to copy skills/ on its own, and a copied skill then carried no terms at all. Every SKILL.md now states license: MIT. The metadata test also enforces the two spec limits every host reads: a conformant name and a description within 1024 characters. Claude Code is lenient about both, so a violation keeps working here and fails silently wherever else the directory is copied. Neither field counts toward the fixed context budget, which stays at 4580. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The hook already emits all four SessionStart envelopes and usage-lib already detects all four hosts, but only Claude Code and Codex had tests. The two nobody runs day to day could have been dropped by a refactor without anything failing. Covers the envelope field each host reads, the recorded platform, the absence of guide seeding outside the two primary hosts, and the neutral invocation note that non-primary hosts receive instead of Claude Code's Skill-tool wording. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A skill is executable context: it enters an agent already holding the user's credentials and file system. Public catalogues scanned in 2026 carried prompt injection and credential exfiltration in a large minority of entries, so this plugin should check the claim rather than promise it. Scans every shipped file for network egress, credential and private-key paths, piping into a shell, decoded or indirect execution, and invisible or bidirectional Unicode that hides instructions from a human reading the diff. Each rule carries a sample it must still match. A scanner whose pattern quietly stops matching is worse than no scanner, because it reports success forever. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
States the agentskills.io conformance the tests now enforce, names the four SessionStart envelopes, and marks Cursor and Copilot as conformant-but-unproven rather than supported, because nobody has run them end to end. Adds a security section covering what the scan checks, the no-network and no-telemetry claim, and the single local sink that claim depends on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Portability and safety guards only. No skill behavior changes and the fixed context baseline is untouched at 4580. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CLAUDE.md was ignored as local working notes but its Codex twin was not, so the same seeded skeleton was tracked or untracked depending only on which host created it first. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Guards only. No skill behavior changes, and the fixed context baseline is
untouched at 4580 characters.
What this closes
Every skill now carries its own license. The README tells people to copy
skills/on its own; a copied skill previously carried no terms at all.The two agentskills.io limits every host reads are enforced. A conformant
nameand a description within 1024 characters. Claude Code is lenient aboutboth, so a violation keeps working here and fails silently wherever else the
directory is copied.
Cursor and Copilot envelopes are covered by tests. The hook already emitted
all four SessionStart envelope shapes and
usage-lib.shalready detected allfour hosts, but only Claude Code and Codex had tests — the two nobody runs
daily could have been dropped by a refactor without anything failing. They are
documented as conformant-but-unproven, not supported, because nobody has run
them end to end.
The shipped surface is scanned in CI. Network egress, credential and
private-key paths, piping into a shell, decoded or indirect execution, and
invisible or bidirectional Unicode that hides instructions from a human reading
the diff. Every rule carries a sample it must still match, so a pattern that
quietly stops working fails the build instead of reporting success forever.
A pre-existing bug is fixed.
tests/test-hooks.shwas unrunnable onWindows: it tried
python3andpythononly, both of which resolve to theMicrosoft Store stubs that pass
command -vand exit 49 — the condition thefile's own comment already described. Confirmed pre-existing against the base
commit before fixing.
Verification
All four suites pass locally: metadata, safety, Linux hook via Git Bash, and
Windows hook. Fixed context measured at 4580 against a 4580 budget, unchanged.
Both new test groups were checked against deliberate breakage rather than
trusted for passing once. Cursor's output field was renamed and a
curllinewas planted in a shipped file; each was caught, then reverted.
🤖 Generated with Claude Code