skills/meodai__skill.color-expert
1
0
Fork 0
mirror of https://github.com/meodai/skill.color-expert.git synced 2026-09-14 20:16:47 +08:00
Code Issues Packages Projects Releases Wiki Activity

Redact username from SECURITY.md path examples

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
David Aerne
2026-03-24 00:09:53 +01:00
parent 520cf3de5c
commit 4bcfa4a3a5
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+2 -2
View File
@@ -22,7 +22,7 @@ The reference files are a knowledge base, not executable prompts. They contain n
This repo contains no `settings.json`, `settings.local.json`, or any configuration that grants shell, network, or filesystem permissions. The entire `.claude/` directory is gitignored.
A `settings.local.json` existed briefly in early commits (the maintainer's local dev permissions for downloading PDFs and transcribing videos during curation). It was removed in commit `ea1f821` and the `.claude/` directory was gitignored. It is not present on the current branch and has no effect on skill consumers — `settings.local.json` files are per-machine and never loaded from imported skills.
A `settings.local.json` existed briefly in early commits (the maintainer's local dev permissions for downloading PDFs and transcribing videos during curation). It was removed in commit `ea1f821` and the `.claude/` directory was gitignored. It is not present on the current branch and has no effect on skill consumers — `settings.local.json` files are per-machine and never loaded from imported skills. The file contained only the maintainer's local tool permissions (e.g. `curl` to archive.org, `yt-dlp` for transcripts) used during content curation.
## Reported False Positives
@@ -30,6 +30,6 @@ A `settings.local.json` existed briefly in early commits (the maintainer's local
- **PROMPT_INJECTION risk from reference files** — The 113 markdown files in `references/` are curated summaries of color science literature. They contain no agent instructions, no tool calls, no role-play prompts, and no behavioral overrides. The content is factual (color spaces, pigment chemistry, perception research). Treating educational content as an injection vector would flag any knowledge base, textbook, or documentation site.
- **DATA_EXFILTRATION via absolute paths** — The flagged paths (`/Users/meodai/...`) appeared only in the now-removed `settings.local.json`. This file was the maintainer's local development configuration and is no longer tracked. No absolute paths exist in any shipped skill content.
- **DATA_EXFILTRATION via absolute paths** — The flagged paths (e.g. `/Users/m.../Sites/...`) appeared only in the now-removed `settings.local.json`. This file was the maintainer's local development configuration and is no longer tracked. No absolute paths exist in any shipped skill content.
- **COMMAND_EXECUTION via settings** — The flagged `settings.local.json` is not part of the distributed skill. It was the maintainer's local dev environment for curating content (downloading PDFs from archive.org, transcribing YouTube videos). It was removed from the repo and `.claude/` is gitignored. Skill consumers never receive this file.