Epic: Harden skill trust boundaries without reducing capability

[shaug]

Outcome

Reduce the real attack surface behind the current skills.sh security warnings and make every remaining intentional capability explicit, testable, and auditable without removing the GitHub, Linear, repository-validation, shell, or database-comparison behavior these skills exist to provide.

A successful closeout improves the code and the accuracy of scanner explanations. It does not require every automated badge to become green: Snyk W011 is an inherent exposure for workflows that must read outsider-authored issue, review, and CI content.

Current evidence

The skills.sh installation report currently shows:

• Snyk W011 medium-risk exposure where lifecycle and review skills ingest third-party prose;
• Socket low-severity anomalies for implement-epic's transitive implement-ticket trust boundary;
• Gen/Socket findings for carve-changesets command strings executed with shell=True; and
• Socket concern about database-comparison stdout persisted to disk.

The scanners found no high/critical verdict, backdoor, secret-exfiltration behavior, or malicious payload. This epic therefore owns focused defense-in-depth work, not a redesign or a scanner-appeasement exercise.

Child tickets

• Bind implement-epic delegation to an installed repository-owned implement-ticket #68 — bind implement-epic delegation to an installed repository-owned compatible implement-ticket.
• Keep carve-changesets database comparison output ephemeral by default #69 — keep carve-changesets database-comparison output ephemeral by default while retaining explicit output persistence.
• Enforce untrusted-content boundaries across tracker and review workflows #70 — enforce and evaluate untrusted-content boundaries across tracker and review workflows.
• Replace implicit shell command strings with argv execution in carve-changesets #71 — replace implicit shell command strings with argv execution while preserving explicit shell capability.

GitHub native parent/sub-issue and blocker relationships are the source of truth. This list is a reader-oriented summary only.

Dependency and execution shape

Initial parallel-ready children:

• Bind implement-epic delegation to an installed repository-owned implement-ticket #68 — dependency provenance boundary;
• Enforce untrusted-content boundaries across tracker and review workflows #70 — untrusted-content boundary and adversarial evaluations; and
• Replace implicit shell command strings with argv execution in carve-changesets #71 — argv command specification and executor.

#69 is blocked by #71. Database-output lifetime should be implemented against the final argv-based command executor so the two tickets do not independently redesign db_compare capture and failure semantics.

No other blocker edge is justified. #68 and #70 touch related orchestration prose but neither consumes an artifact produced by the other.

Epic acceptance criteria

• All four native child issues are closed only after their own acceptance criteria pass.
• implement-epic refuses missing, third-party, incompatible, dynamically fetched, or unverifiable implement-ticket dependencies before child mutation while preserving a valid installed repository-owned path.
• Tracker, repository, review, CI, and packet prose remains usable as verified evidence but cannot grant authority, override policy, request secrets, or supply executable commands.
• Adversarial and legitimate-control evaluations cover the affected GitHub, Linear, review, CI, command-discovery, and dependency-provenance boundaries.
• Production carve-changesets command execution contains no subprocess.run(..., shell=True) path; ordinary commands use exact argv boundaries and approved shell semantics remain available only through an explicitly selected shell executable.
• Database comparison leaves no persistent raw output by default and retains exact raw output only through an explicit, permission-restricted persistence option.
• Existing branch restoration, clean-tree, immutable-source, dry-run, authority, review, publication, propagation, and terminal-result guarantees remain intact.
• Existing legitimate GitHub, Linear, repository validation, database comparison, and review workflows remain supported.
• Canonical and bundled review contracts remain byte-identical wherever touched.
• just format, just lint, and just test pass on the integrated main result.
• README and CHANGELOG.md accurately describe user-visible compatibility or safety changes.
• The latest integrated skills are rescanned through the normal skills.sh flow and the before/after Gen, Socket, and Snyk results are recorded. A remaining exposure-based W011 is documented rather than hidden or treated as an epic failure.

Closeout evidence

Before closing this epic:

1. verify every child outcome is represented on current main;
2. run the required clean-main repository gates;
3. read back native parent, subIssues, blockedBy, and blocking relationships;
4. inspect the current per-skill security reports after rescan;
5. confirm that no mitigation removed an intended capability or weakened an authority/review gate; and
6. record residual scanner findings with their intentional capability and tested mitigation.

Non-goals

• Eliminate third-party-content exposure by ceasing to read GitHub, Linear, review, repository, or CI content.
• Promise that heuristic or model-based scanners will downgrade every report.
• Obscure, relocate, or rename risky behavior merely to evade static analysis.
• Remove arbitrary approved repository validation, explicit shell programs, database comparison, or raw-output retention when deliberately requested.
• Redesign the review-v2 architecture or absorb provisional work from Epic: Make review-clean verdicts evidence-backed and empirically evaluated #49.
• Add a package manager, central dependency registry, new policy framework, or runtime-specific mandatory API.
• Broaden merge, deployment, communication, tracker-transition, cleanup, or destructive authority.

[shaug]

Epic closeout evidence

Epic #72 is acceptance-complete on current main at
05115700296eddc20fe5462e38e9c4211c49d4b3.

Native graph and integrated children

All four native sub-issues remain parented to #72 and are closed:

Child	Delivery	Candidate SHA	Merge SHA
#71	#74	7da1a75ad585bddec6be1cc4743e77a1744c4e98	e14f0db21beb66b1c432d1743ec8c10cf00ff39d
#68	#75	569b11ec60977c19c66092690ffdada0dbac1eb4	b2130dc742d6c81e50499eda4e4cc318ece471dc
#70	#76	ff3f4b9cca9b062a7113b95ab08bd1d36331a27c	366c52e062671eecabcb00f40477867547782614
#69	#78	2f13a2d6c27fda2ced66558460a72c11c4d43c26	05115700296eddc20fe5462e38e9c4211c49d4b3

Each candidate is an ancestor of current origin/main. The native blocker edge
#71 blocking #69 / #69 blocked by #71 remains intact, and both ends are
closed. There are no open blockers on the epic or its children.

Acceptance ledger

• Bind implement-epic delegation to an installed repository-owned implement-ticket #68 binds implement-epic to an installed, repository-owned, compatible
  implement-ticket and fails closed before child mutation for missing,
  third-party, incompatible, dynamically fetched, or unverifiable
  dependencies.
• Enforce untrusted-content boundaries across tracker and review workflows #70 treats tracker, repository, review, CI, and packet prose as untrusted
  evidence: it remains available for verified requirements but cannot grant
  authority, override policy, request secrets, or supply executable commands.
• Replace implicit shell command strings with argv execution in carve-changesets #71 removes every production shell=True path from carve-changesets.
  Ordinary commands preserve exact argv boundaries; deliberately approved
  shell semantics require an explicitly selected shell executable.
• Keep carve-changesets database comparison output ephemeral by default #69 makes database-comparison raw output ephemeral by default in a
  permission-restricted temporary directory, cleans it on success and failure,
  and retains exact raw output only through --keep-output-dir or the
  compatible explicit --out-dir option.
• Existing branch restoration, clean-tree, immutable-source, dry-run,
  authority, review, publication, propagation, and terminal-result guarantees
  remain covered by the integrated suite. GitHub, Linear, repository
  validation, database comparison, explicit shell-program, raw-retention, and
  review workflows remain supported.
• Canonical review contracts and all four bundled copies are byte-identical;
  the bundled validators also execute successfully in installed layout.
• README.md still describes the supported dependency/lifecycle shape, and
  the 2026-07-27 CHANGELOG.md section records all four user-visible safety
  changes.

Clean-main validation

Validation ran from a detached clean worktree at the exact current
origin/main SHA above:

• git diff --check — pass
• just format — pass, 92 files unchanged
• just sync-contracts — pass
• just lint — pass, including skill validation and plugin packaging
• just test — pass, 521 tests
• just eval-implement-epic — 15/15
• just eval-carve-changesets — 3/3 integration self-tests and 12/12 forward cases
• just eval-implement-ticket — 54/54
• production skills/carve-changesets search for shell=True — no matches

skills.sh rescan

The normal installer flow was rerun in an isolated throwaway project:

npx skills add shaug/agent-scripts --skill '*' --agent codex -y --copy

It cloned the current eight-skill source, and the installed skill trees were
byte-identical to the integrated main trees (excluding test-created
__pycache__ directories).

Skill	Gen before -> after	Socket before -> after	Snyk before -> after
babysit-pr	Safe -> Safe	0 -> 0 alerts	Medium -> Medium
carve-changesets	Medium -> Safe	3 -> 3 alerts	Medium -> Medium
implement-epic	Safe -> Safe	1 -> 0 alerts	Medium -> Medium
implement-ticket	Safe -> Safe	0 -> 0 alerts	Medium -> Medium
review-code-change	Safe -> Safe	0 -> 0 alerts	Low -> Low
review-code-simplicity	Safe -> Safe	0 -> 0 alerts	Low -> Low
review-correctness	Safe -> Safe	0 -> 0 alerts	Low -> Low
review-solution-simplicity	Safe -> Safe	0 -> 0 alerts	Medium -> Medium

Current details: https://www.skills.sh/shaug/agent-scripts

The intended improvements are visible: Gen now rates carve-changesets safe,
and Socket cleared the implement-epic alert. Socket still reports three
carve-changesets anomalies whose published detail describes the now-removed
shell=True and default raw-output persistence paths. That residual report is
recorded rather than hidden; the exact installed source, production-source
search, and integrated tests contradict those stale implementation claims.

Snyk still reports W011 medium risk for babysit-pr, carve-changesets,
implement-epic, implement-ticket, and review-solution-simplicity. This is
the intentional exposure required to read outsider-authored issue, review, CI,
repository, and plan prose. The mitigation is the tested untrusted-evidence
boundary from #70, not removal of those workflows. The remaining three review
skills stay low risk.

Final review and release boundary

PRs #74, #75, #76, and #78 are merged with successful exact-head CI. A fresh
late-feedback sweep found zero conversation comments, zero formal reviews, and
zero review threads on all four PRs. No deployment or release artifact is
required for this skills repository epic.

All parent acceptance criteria are satisfied; closing #72 is appropriate.