skill-vetting-security-invariantslisted

Load when editing hooks/skill_snapshot.py or hooks/skill-vetting-advisory.py, changing the digest/baseline/anomaly logic, editing skills/skill-vetting/SKILL.md §3, touching the display allowlist or the digest/record/status CLI, or about to cite G3/G3-SHELL/any I-numbered invariant as met. A runtime-hook change that also adds/edits a test or makes a test/evidence claim ALSO loads mutation-matrix-evidence-discipline. Behavior-only runtime work uses this skill rather than mutation-matrix (and vice-versa) — that split is only about the security↔mutation pair and does not suppress security-hardening-review-ops during a hardening campaign or a security-sensitive push/PR/merge.
F-e-u-e-r/opus-pack · ★ 2 · AI & Automation · score 68

Install: claude install-skill F-e-u-e-r/opus-pack

# skill-vetting security invariants The `skill-vetting` advisory tripwire is a SessionStart hook that watches installed skills and injects one advisory line when one appears, changes, disappears, or cannot be fully observed. Its threat model treats **the author of watched content (ADV-1) as controlling every byte, name, type and shape** under the watched trees; same-privilege local code (ADV-2) is out of scope by design. These invariants shipped hardened in **PR #83 (`7cd2af6`, merged 2026-07-26)** over a multi-round cross-family campaign; the design record `reviews/2026-07-25-skill-vetting-snapshot-threat-model.md` defines **goals G1–G6 + G3-SHELL and invariants I1–I11** (I12–I17 belong to the *unimplemented* round-8 design — see the last section). Each invariant below violates "breaks users you cannot see": a silently-missed trojan edit, a discarded BLOCK, a hung session start. ## Boundary map | Path | Role | |---|---| | `hooks/skill_snapshot.py` | observation + persistence primitive: `scan_root`, `snapshot_tree`, canonical digest, baseline I/O, and the `digest`/`record`/`status` CLI. Decides no verdicts. | | `hooks/skill-vetting-advisory.py` | thin SessionStart hook: resolves roots, compares snapshot vs baseline, composes/delivers the advisory, advances the baseline. No filesystem-walking of its own. | | `skills/skill-vetting/SKILL.md` | the procedure an agent follows to vet a candidate; §3 binds a verdict to an exit-0 digest. | The two files are imported in-process, n