7 Commits

Author	SHA1	Message	Date
kz-tob	4b1b74b181	Give differential-review a trigger, and name every component in its README (#278) ... * Give differential-review a trigger, and name every component in its README differential-review's description listed what it does and never named a situation, so it competed on capability wording alone. It now closes with the triggers its own README already documents — reviewing a PR, commit, or diff; checking whether a change re-introduces a fixed bug; asking what else a change could break; finding modified code with no test. The same plugin's README never mentioned adversarial-modeler, which is what Phase 5 dispatches for HIGH RISK changes. Checking whether that was isolated turned up more of it, and the sweep found three kinds of gap: zeroize-audit's agent table was missing three of its eleven agents — 0-preflight, which gates the entire run, plus 5b-poc-validator and 5c-poc-verifier. All three appear in the phase diagram directly above the table, which is why they read as present. constant-time-analysis documents the ct-analyzer CLI end to end and never says the plugin also ships a skill and a command. entry-point-analyzer lists phrases that trigger its skill but never names the skill or its command. Three more READMEs describe their skill without naming it. That matters most where the skill name is not the plugin name and a user cannot guess it: chrome-mcp-troubleshooting and interpreting-culture-index. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix review findings and make the README sweep a gate The two PoC rows I added to zeroize-audit said Phase 4. The diagram three lines above them, SKILL.md, and workflows/phase-5-poc-validation.md all say Phase 5, steps 5a and 5b. "Wave 5a" is a label that exists nowhere. A debugger consulting the table — the artifact this branch designates as what runs when — would have opened phase-4-poc-generation.md and found no validation in it. Also corrected the sentence introducing that table, which still said 10 agents across 8 phases against 11 across 9, and the Phase 0 diagram line, which still credited the orchestrator for a gate the new row credits to 0-preflight. differential-review's README claimed the agent is "dispatched", and named it bare in a column whose other rows are namespaced. Nothing dispatches it: the only instruction is prose in SKILL.md, and a bare subagent_type fails at runtime. Namespaced both, and corrected the five stale line counts in the same file — reporting.md is 369 lines, not the ~120 the token-efficiency section budgets for. Drop the dead `name: trailofbits:<cmd>` key from five command files. The three newest command files carry no name: at all, #275 namespaced 22 bare invocations, and this branch documents the `/<plugin>:<cmd>` form — so the key contradicts the docs it sits next to. Then make the sweep repeatable. Doing this by hand three times found eight gaps and missed two more, both of the same shape: a workflow ships under meta.name, not its filename, so a README citing the filename never writes the name a reader types. The validator now checks that a README names every skill, agent, command, and workflow its plugin ships, reading meta.name for workflows. It refuses a run that inspected zero components, and six self-test assertions hold it to known-bad fixtures. It found git-cleanup on its first run: ships as /git-cleanup:git-cleanup-analysis, README cites workflows/analyze-branches.js four times and that name never. static-analysis had the same gap for codeql-build. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fix both P2s: the gate was a substring test, and the dispatch was still bare The README gate ran `name not in text`. That reads as thorough and could not fail for a large share of what it counted: `draw` was satisfied by "(draw cards instead)", `semgrep-rule` by the plugin's own name in the install line, `burp-search` by a `scripts/burp-search.sh` path that is a different thing, and `audit` by the prose "shared-state struct audit". Match by kind instead. Commands and workflows are reachable only as `/<plugin>:<name>`, so require that literal — it is the only string a user can type. Agents are dispatched by identifier and never typed as prose, so require an identifier-shaped mention. Skills are genuinely referred to by bare name, so require only a delimited occurrence, which is what stops "draws" counting as `draw`. That surfaced seven real gaps, the four above plus insecure-defaults' audit-pipeline workflow, mutation-testing's skill, and trailmark's code-slice-worker. All seven fixed. adversarial-modeler was still bare at SKILL.md:96. Line 77 was the decision-tree mention; line 96 is the "Delegate to this agent" instruction a model actually acts on, so the runtime failure the last commit claimed to fix survived it. Namespaced, and it now says why. Also from the review: a per-kind floor, since a single total stays healthy while skill_files() — 63% of coverage — silently stops matching; workflow_names anchored to the meta block, because a bare search takes any earlier `name:` in a comment, and .mjs was invisible; and AGENTS.md documents the new hard failure. Self-test 88 -> 96, each new rule with a negative control. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-26 08:54:12 -04:00
Dan Guido	43d16a56d8	zeroize-audit: give SKILL.md a run entry point and link the Rust patterns reference (#267) ... * zeroize-audit: give SKILL.md a run entry point, link Rust patterns SKILL.md described what the skill finds but never told the model how to start a run: prompts/task.md, which holds the phase loop the whole pipeline hangs off, appeared only as a parenthetical in a table caption. Add a "How to Run" section that maps a user request onto collecting the inputs, reading task.md and system.md, executing the phase loop over workflows/phase-{N}-*.md, and returning final-report.md, plus the orchestrator-state.json resume path. references/rust-zeroization-patterns.md had no inbound reference from anywhere in the plugin. Link it from SKILL.md's detection strategy and from the two Rust analyzer agents, each pointing at the section covering the patterns that agent's scripts match: Section A/B from 2b-rust-source-analyzer, Section C from 3b-rust-compiler-analyzer, with Section D flagged there as a coverage gap a clean run does not rule out. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Correct the completeness claims in the new reference links Review found the link text overstated what the pattern reference covers, in a way that risks suppressing real findings. Verified against the scripts and corrected: - Section C documents 12 patterns, not every pattern the three scripts match: check_mir_patterns.py defines 8 detectors against 3 entries, and check_llvm_patterns.py emits classes for secret return values and by-value aggregate arguments with no entry at all. The 3b agent now says Section C is a subset and that a pattern with no entry is still a valid finding carrying the script's own evidence, so a missing entry cannot read as "not a real pattern". - Section A is not a 1:1 map of the 2b bullet list: the missing-zeroize-dependency check has no entry, and A6 (ManuallyDrop<T> field) has no bullet. Counts coincide at 12; contents do not. - 34 of the 40 patterns are detected; Section D's 6 are known gaps, so SKILL.md no longer calls all 40 "what the tooling looks for". - C-ASM3 and C-ASM4 carry no snippet, so "each entry gives a reproducing snippet" is now "most also give". Also fill in the max_tus and mcp_timeout_ms defaults from schemas/input.json, which the new "leave other fields at their defaults" step depends on, and add the three reference files missing from the README index, including the one this branch de-orphaned. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * zeroize-audit: register the agent dispatches and route coverage gaps to the report The run path this PR documents dispatches every agent by bare name — twelve sites across the phase workflows, none carrying a subagent_type — so the first thing a user hits after following the new "How to Run" section is an unregistered dispatch. Namespace all twelve as `zeroize-audit:<agent>`, matching rust-review and the names the agent files actually declare. The Section D paragraph told 3b to record unaudited patterns in notes.md, but the report assembler reads only the *-findings.json files, so a crate using `Arc<SecretKey>` or a `static LazyLock<MasterKey>` produced a final report indistinguishable from a crate using neither. Write them to coverage-gaps.json instead, have the assembler read it, and require Analysis Coverage to state either the gaps or that none were reported — a missing line reads as full coverage. 2b told the agent to use a Section A snippet to judge whether a flagged type "is a false positive", with nothing in the file permitting or recording a drop; 3b already carries a "never drop or downgrade" guard. Give 2b the same guard: a weak match is a needs_review finding whose evidence says how the code differs, never an omission. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014UFqJu1ada7gXjD9peo1rX * zeroize-audit: drop the duplicated merge paragraph in the assembler The Step 1 collection section carried the same instruction twice, the second copy predating the rust-compiler-analysis directory it omits. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014UFqJu1ada7gXjD9peo1rX * zeroize-audit: arm the dispatch check and make the coverage survey real The namespaced dispatches were written as `` `subagent_type: zeroize-audit:X` ``, which matches neither validator extractor — both need a quote or backtick immediately after the colon — so validate_subagent_dispatch inspected zero sites in this plugin and a regression back to a bare name would have passed CI. Quote the values; the validator now sees all twelve, and reverting one to a bare name fails the build. coverage-gaps.json was read as item 4 of Step 1, but Mode Branching runs Step 1 in interim mode only while Analysis Coverage is Step 6, final-only — so the file was read, discarded, and the report still said "no coverage gaps were reported". Read it where it is used instead. Nothing told 3b to perform the Section D survey: the paragraph sat above Step 1, the numbered steps never looked, and the agent reads only MIR/IR/assembly while five of the six D patterns are source constructs. Add Step 6 with the grep markers and the sensitive-type filter, require the file unconditionally so an empty survey is distinguishable from no survey, and declare it in the phase-2 workflow, the always-write list, system.md's layout, and the report template. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014UFqJu1ada7gXjD9peo1rX --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: kz-tob <kara.zaffarano@trailofbits.com>	2026-08-24 09:27:02 -04:00
Dan Guido	9e06dc67a3	Make every documented command runnable under our own python shims (#258) ... * Make every documented command runnable under our own python shims The modern-python plugin ships PATH shims that refuse `python <script>`, `pip install`, `python -m pip` and `uv pip install`. Twelve other plugins in this marketplace issued exactly those forms, so installing our own plugin broke our own skills — and CI was green throughout. The worst case was not theoretical. c-review and rust-review both call their Phase 4 planner as `python3 "${PLUGIN_ROOT}/scripts/build_run_plan.py"`, so with the shim installed every run died before spawning a worker. Verified both directions: the new form exits 0 with the shim on PATH, the old form exits 1. Phase 1's reading pass named 16 skills. A mechanical sweep found 96 candidate lines across 44 files, and scanning shell scripts as well as markdown found 10 more the docs sweep had missed. That gap is the reason the check below exists. The fix is not one substitution. Four classes needed different treatment: - Our own scripts become `uv run --no-project <script>`. Not bare `uv run`, because these execute inside the *target* repo, which may be a Python project that cannot resolve; verified against a broken pyproject.toml and against validate_artifacts.py's sibling import of generate_sarif. - Package installs become `uv add` for a dependency, `uv tool install` for a CLI, `uv sync` for a project's own editable install. - Third-party CLIs we merely document — OSS-Fuzz's infra/helper.py, yarGen — become `uv run --no-project python <script>`, which keeps upstream's exact semantics rather than handing their script an environment we manage. - atheris's instrumented build keeps its source build, as `uv add --no-binary-package cbor2`. Dropping that flag would silently produce an uninstrumented fuzzer, which is worse than a visible failure. Its prose was updated to name the flag it now uses. Two factual corrections fell out. `pip install caracal` was wrong twice over: caracal is a Rust tool (Cargo.toml at its root), so it is now upstream's own `cargo install --git`, not a uv equivalent that would fetch an unrelated PyPI package. And `pip install uv` cannot bootstrap uv under a shim that intercepts pip, so culture-index now points at the official installer. Thirteen lines stay as they are, each deliberately: Dockerfile `RUN` lines and oss-fuzz's build.sh run in containers where our shims are absent; codeql's pip calls install the *analysed* project's dependencies, and that project is arbitrary; trailmark's dispatch skills must keep saying "Do NOT run `pip install`"; and modern-python documents what it intercepts. `make shell-suites` passes again as a result — exit 0 with the 1.6.0 shim, where AGENTS.md previously recorded it as broken by variant-analysis. The guardrail: check_python_invocations scans 698 markdown and shell files and fails on the four refused forms, with structural exemptions for dockerfile fences and an `allow-legacy-python: <reason>` marker that scopes to its code block. Eleven self-test fixtures cover it, four asserting it fires and seven asserting it stays quiet on the compliant forms. It was mutation-tested in both languages, and it caught its own worst bug during development: unanchored patterns first flagged `uv run --no-project python fuzz.py`, the very form the advice recommends. Self-test goes 45 -> 56. * Review pass: fix the atheris flow, drop a stray exemption, trim comments Three corrections from reviewing the branch diff: - atheris's install now opens with `uv init --bare`, without which the documented `uv add atheris` errors in a bare harness directory. The old pip form assumed an activated venv, so setup was always implicit; now it is one explicit line. - ossfuzz carried an allow-legacy-python marker on a C++ build block that contains no python at all — yesterday's insertion matched the first of three "Build in build.sh" headings instead of the python one. The exemption now sits only on the block that needs it. - The anti-vacuity message said "read no markdown" for a scan that also covers shell scripts. The rest is weight: the new check's comment blocks, the hardcoded-path constants' commentary, the AGENTS.md bullets and the three exemption markers all said the same things at two to three times the length. Each keeps its one-line why; the narratives are gone. No behavioural change — self-test still passes 56 assertions and the full scan is unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Address the review: fix where packages land, widen the check to match the shim The review's core insight was right twice over. Several substitutions had changed WHERE a package lands, breaking the documented next step, and the checker enforced a narrower invariant than the shim it exists to mirror. Where packages land: - trailmark is imported as a library from five skills, and a `uv tool install` environment is not importable — the retry loop at trailmark/SKILL.md:47-51 would have spun forever on the exact error it names. The CLI install stays `uv tool install`; the import snippets now run under `uv run --with trailmark python -`. - `uv add` writes to the manifest of whatever project you are standing in, which for sarif-parsing is the audited repo. Its scripting rows, ijson comment and jsonschema example now use `uv run --with <pkg>`, which leaves no trace. atheris keeps `uv add` deliberately: the fuzzing harness is the user's own project, made explicit by `uv init --bare`. - `uv sync` leaves ct-analyzer in .venv/bin, so the README's very next line failed with command not found. Now `uv tool install .`, verified end to end: the console script lands on PATH and --help runs. - yarGen needs pefile/lxml/yara-python, which `--no-project` had detached; now `uv run --with-requirements requirements.txt`. - The cbor2 source-build preference now persists via `no-binary-package = ["cbor2"]` under [tool.uv] (field verified against uv's accepted-settings list), so a later `uv sync` cannot silently swap in an uninstrumented wheel. The checker, widened to the shim's actual behaviour: - `python3 --version` and `python3 -u foo.py` are refused by the shim but passed the old patterns; one live instance (constant-time-analysis README) proved it. Both forms are now caught. - Every `uv pip` subcommand is refused, not just install; `-t` joins the allowed tool-managed flags. - .py files are scanned too: usage strings and error messages told users to run refused commands from ten scripts, including the --help of the very planner this PR fixed. All rewritten. - The evals/tests exemption now tests path parts relative to plugins/, so a checkout under a directory named tests no longer exempts every file. - An allow-marker's scope ends at a blank line as well as a fence, so one marker cannot blanket a whole file; quality-assessment.md gains the second marker that scoping made necessary. Also from the review: zeroize's preflight gets `which python3` back (a helper script still needs the binary; the shim never required removing it), the Makefile's shell-suites note no longer describes an interception that is gone, and the cairo CI example warns that it rebuilds caracal from source each run. Self-test 56 -> 63; every new pattern and exemption is fixture-covered and was mutation-probed against the real tree. Full scan: 0 findings over 773 files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Address the second review: prerequisite probe, checker parity, package placement The review's P2 was a regression this PR introduced for a population the first fix ignored: c-review and rust-review now require uv, and a box with python3 but no uv would die at Phase 4 exactly the way shimmed boxes died before. Phase 1 (Prerequisites) in both skills now probes `command -v uv` and aborts with install guidance. zeroize-audit's preflight already checked uv. The four converted shell suites gain the same guard with a clear message instead of a bare 127 mid-run. Checker parity with the shims, second pass: - pipx and the non-install pip subcommands are refused by catch-all shim arms and passed the checker; both get named-subcommand patterns. - A script named by variable or path (`python3 "$MERGE"`) has no `.py` token; a new pattern covers it and immediately caught one live instance — a codeql test stub that fakes uv itself, now carrying an allow-marker with its reason. - finditer everywhere: a compliant `uv run` earlier on a line no longer masks a refused command later on it, which was exactly the table-cell case the unanchored design exists for. - Prohibition phrases now test the text BEFORE the match, so "Use `pip install semgrep` instead of the tarball" is flagged while "Do NOT run `pip install`" stays exempt. - The uv-pip allowance matches whole flags after the command, so `--target-dir` no longer counts as `--target` and a trailing `-t /tmp` does; `uv pip` precedes `pip` in the pattern order so its lines get the right advice; a pip match directly after `uv ` defers to the uv-pip verdict instead of double-reporting. Package placement, continued from the same insight as round one: - yarGen regains --no-project alongside --with-requirements, plus a cd into the checkout so requirements.txt resolves where it lives. - sarif-parsing's jsonschema example no longer names a script that does not exist, and the table's run-forms show a concrete script.py. - culture-index's two messages now agree and name the actual remedy (`uv run --project` on the scripts directory) instead of re-adding a dependency its pyproject already declares. - merge_sarif's usage line gains --no-project; the generator plugin's install section stops prescribing a venv its own runner never uses. - generate_poc declared requires-python >=3.9 while using `str | None` in a signature, a TypeError on 3.9 that uv's interpreter selection made reachable; now >=3.10. - The GitLab CI example exports ~/.local/bin onto PATH, without which `uv tool install` warns and the next line dies command-not-found. Self-test 63 -> 71; the masking, prohibition-direction, flag-position and pipx cases are all fixtures, and each new pattern was probed live against the tree (plant, error, remove, clean — 0 findings over 773 files). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Address the third review: importable trailmark, honest probes, sturdier scan The P2 was the residue of round two's own fix, applied to the siblings but not the flagship: trailmark/SKILL.md told the model to cure an import error with `uv tool install`, which cannot cure it — a tool env is not importable — while forbidding every fallback. The install block now says what each remedy is for: `uv tool install` for the CLI, `uv run --with trailmark python -` for the snippets, and the other five library-first docs carry the same one-line annotation next to their install command. Empirically settled rather than taken from the review: `uv run python3 <script>` works fine under the shims — uv prepends its environment's bin directory, so python3 resolves to a real interpreter, not the shim. The review's claim to the contrary would have meant rewriting the Makefile and a bats suite; a two-minute transcript said no. Also declined: a zeroize uv-prerequisite (its preflight already lists uv and uvx; the C/C++ `which` line now names uv too). Real and fixed: - ct-analyzer's availability probe ran `python3 --version` by subprocess — the one refused form — so under the shims it reported "Python is not available" on machines where it plainly is. It now probes sys.executable, the interpreter the analyzer itself runs under. Verified under the shim: probe returns True. - The flag step-over in both script patterns handles long and value-taking flags (`python3 -W ignore harness.py`, `--verbose tool.py`), matching the shim's two-slot consumption. - A bare `allow-legacy-python:` with no reason no longer exempts anything; the reason the docs demand is now enforced. - `uv run {baseDir}/...` gets --no-project at the ten semgrep and culture-index call sites that round two missed, and the culture-index remediation strings now name that same runnable command instead of a --project mechanism nothing uses. - pip gains cache/config; the pattern comment now says the subcommand list is deliberately a subset. - Both filesystem scans skip .venv/node_modules-style directories, after a stray local .venv (left by this session's own uv probe, and invisible to CI) turned the path scan red. Smaller review items: the uv-probe prose says "Phase 4 onward" rather than a wrong phase range, run_fixtures' comment stops claiming PEP 723 headers its stdlib-only helpers do not have, the yarGen one-liners say to run from the checkout, `uv tool install` sites note or export the tool bin dir the way a fresh container needs, and sarif-parsing's table column says Install / run and stops naming a file that does not exist. Self-test 71 -> 74. Full scan: 0 findings over 773 files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-19 13:39:07 -04:00
Lixin2026	d5fe2e6a78	feat(codex): add UI metadata for skills (#175) ... * feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-05 12:28:41 -04:00
William Tan	f09e5c729a	Remove legacy codex compatiblity scripts/shims. (#173) ... * Remove legacy codex compatiblity scripts/shims. Codex supports claude plugins so this shouldn't be necessary. Add a script to test the plugin loadablility in both claude and codex * fix: resolve code review findings for PR #173 Review findings addressed (4 reviewers: pr-review-toolkit agents, Codex gpt-5.3-codex, direct diff review): P2 fixed: - Bump versions for the 5 substantively changed plugins in both plugin.json and marketplace.json (gh-cli 1.5.0 new skill, claude-in-chrome-troubleshooting 1.1.0 skill rename, modern-python 1.5.1 / skill-improver 1.0.3 hooks change, zeroize-audit 0.1.1 MCP config relocation) so clients pick up the changes - README Codex install: replace unpasteable /plugins slash-command block with verified CLI syntax (codex plugin marketplace add) - check_claude_loadability: parse_json_output now fails fast with command context on empty CLI output instead of returning None - check_codex_loadability: surface skipped RPC error messages in timeout failures instead of a bare TimeoutError P3 fixed: - Both checkers: error out when marketplace.json lists no plugins instead of passing vacuously Dismissed: - @latest CLI installs in validate.yml: deliberate; the check validates against the clients users actually run - select.select portability: CI-only script on ubuntu-latest - Divergent mcpServers validation between checkers: intentional; the Codex checker enforces the repo's .mcp.json convention Verified: ruff, prek, validate_plugin_metadata.py, and both loadability checks pass end-to-end (39 plugins, 74 skills, 2 MCP servers load in Claude Code and Codex) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-05 12:18:09 -04:00
Jonathan Hefner	debfb29c8e	Fix allowed-tools to use spec-compliant space-delimited strings (#139) ... * Fix `allowed-tools` to use spec-compliant space-delimited strings Per the agentskills.io specification, `allowed-tools` must be a single string of space-delimited patterns, not a YAML list. Converted all 23 SKILL.md files from the `- Item` list format to the correct `"Item1 Item2"` string format. Also updated the frontmatter examples in CLAUDE.md and the workflow-skill-design skill template to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix remaining allowed-tools format in firebase-apk-scanner and workflow-skill-design docs - Convert firebase-apk-scanner from comma-separated to space-delimited - Update anti-patterns.md and tool-assignment-guide.md examples from YAML lists to space-delimited strings - Remove unnecessary quotes from SKILL.md template placeholder Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Cover commands, new SKILL.md files, and fix template placeholder Extends the previous spec-compliance fixes: * Convert command frontmatter (commands/*.md) — per Claude Code docs, command files use the same frontmatter as skills, so the same space-delimited rule applies. * Convert three SKILL.md files added since the original PR: mutation-testing, trailmark-structural, trailmark-summary. * Fix the placeholder in the workflow-skill-design template. The previous "[minimum tools needed, space-delimited]" was YAML flow-sequence syntax, which parses as a list — the opposite of what the placeholder claims. Replaced with a concrete-looking space-delimited example plus a comment. Zeroize-audit agent files still use `allowed-tools:` in YAML list form. They are intentionally excluded: per the project's own docs (workflow-skill-design references), agents declare tools with `tools:` (not `allowed-tools:`). Fixing those requires changing the field name as well as the format and is out of scope for this PR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * zeroize-audit agents: switch allowed-tools to tools Subagents declare their tool allowlist via `tools:` (comma-separated), not `allowed-tools:` — see Claude Code's subagent docs and this repo's own designing-workflow-skills/SKILL.md:47: > Skills use `allowed-tools:` in frontmatter. Agents use `tools:` > in frontmatter. Before this change, the zeroize-audit agents declared their tool list under `allowed-tools:`, which Claude Code does not read for subagents. The field was effectively a no-op; the spawned agents had no tool restriction enforced. Renames the field on all 11 agents to `tools:` and reformats the YAML list as comma-separated to match the documented format and existing agents elsewhere in the repo (e.g. function-analyzer.md, spec-compliance-checker.md). Tool sets are unchanged. Behavior change: tools now actually constrain what each spawned agent can call. The lists are the ones the original author intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * skill-improver: convert command allowed-tools to space-delimited The two command files in plugins/skill-improver/commands/ still used the JSON flow-array format (`allowed-tools: ["..."]`), which the rest of this PR converted everywhere else. Convert them to the spec-compliant space-delimited string form for consistency. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>	2026-04-28 19:50:30 -04:00
Dan Guido	ed41cd7ceb	Import five plugins from skills-internal (#108) ... * Import four plugins from skills-internal and clean up README Import seatbelt-sandboxer, supply-chain-risk-auditor, zeroize-audit, and let-fate-decide from skills-internal. Remove dead humanizer and skill-extractor directories. Fold "About Trail of Bits" into the license line. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix CI: shellcheck SC2317 and let-fate-decide description mismatch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Import agentic-actions-auditor from skills-internal Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix review issues across 5 imported plugins - Fix empty array expansion crash under set -u on macOS bash 3.2 (emit_rust_mir.sh, emit_asm.sh, emit_ir.sh) - Fix copy-paste error in seatbelt-sandboxer README ("variant analysis") - Remove references to non-existent leak-hunter skill - Update agentic-actions-auditor license to match repo CC-BY-SA-4.0 - Add PEP 723 metadata to check_rust_asm_{aarch64,x86}.py - Replace unsafe xargs trim with parameter expansion in track_dataflow.sh - Add json_escape function to analyze_asm.sh, analyze_heap.sh, track_dataflow.sh for safe JSON construction with backslashes - Add allowed-tools frontmatter to seatbelt-sandboxer and supply-chain-risk-auditor SKILL.md - Add minimum finding count assertions to run_smoke.sh - Fix double period typo in supply-chain-risk-auditor SKILL.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-26 10:21:20 -05:00