fix(harden): correct three claims and record the evidence spans - #78
Merged
Conversation
svyatov
added a commit
that referenced
this pull request
Aug 11, 2026
## What changed `.skillspector-baseline.yaml` holds one suppression, and the scan in CI and in the `CONTRIBUTING.md` check sequence passes `--baseline` to read it. ## Why this way `oss-harden` cites GitLab's personal access tokens page as the source for the `read_api` and `api` scopes an audit run needs. Skillspector matches the phrase in the link title, reports PE3 Credential Access at HIGH with confidence 0.7, and the score moves from 34 MEDIUM to 52 HIGH, which exits 1. The skill reads no credential file. Rewording the citation would clear the scan by misnaming the source the claim rests on, so the suppression is the honest fix. The entry is a glob rule scoped to that rule id, that file, and that phrase, not a fingerprint. A fingerprint hashes the line span and the message, so it expires on the next edit to the file and returns the finding with nobody having re-read it. Its `reason` says what would make the suppression wrong: `oss-harden` telling a reader to read a token from disk. Baselining every current finding was the alternative. It was rejected because it would suppress all 18 findings scoring today, including two untriaged HIGH ones in `oss-skill/references/hosts.md`. ## Verification `bun test` at 327 pass and `skills/oss-writing/scripts/prose.mjs` clean on the files touched. The suppression itself is not verified here. The finding it suppresses comes from #78, which is not in this branch, so this branch scores 34 with or without the rule. Re-running #78 against this baseline is the first run that tests it. ## Known gaps The 18 findings that score today are untriaged, and two of them are HIGH. This change leaves every one of them scoring exactly as it does now. ## Affects | Rule or skill | Change | | --- | --- | | oss-harden | none, the skill is unchanged |
The skill tells a reader to pin every `uses:` line in a workflow. It misses the ones a shipped composite action carries. It says a cooldown below three days makes the updater slower, where a smaller number shortens the delay. It recommends CodeQL default setup without saying that GitHub excludes fork pull requests from it. A pilot run of the claim verification mechanism found all three by re-reading the sources. Six `Verified` markers now close the spans they sit in, and `AGENTS.md` records five repository facts the same pass found stale.
svyatov
force-pushed
the
fix/harden-pilot-corrections
branch
from
August 11, 2026 16:05
8b13411 to
d601e77
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Three claims in
oss-hardenthat re-reading the current sources found false or incomplete.uses:line in a workflow, and miss the ones a shipped composite action carries. Step 2 now reads everyaction.ymlandaction.yamlin the repository, and Step 3 covers both.Six
Verifiedmarkers close the spans those sentences sit in, each naming the pages read on 2026-08-07.AGENTS.mdrecords five facts about this repository that the same pass found stale: the tag R-SEC-05 cites, the package countsite/bun.lockresolves, the social preview image, the Code Quality setup endpoint GitHub now documents, and R-SEC-09 standing open for fork pull requests.Why this way
The corrections come from a pilot of a claim verification mechanism, not from a skill run that went wrong. The pilot read the current sources for one dense skill file and compared every sentence against them.
A marker attests reading over a span rather than covering one claim, so it carries a date and the pages read instead of a citation per sentence. Six spans fit this file, each closing at a step boundary.
Verification
bun run typecheck,bun testat 327 pass,bun run validate,tests/test-check-drift.sh,scripts/check-drift.sh, andscripts/check-ecosystems.mjsall pass locally.skills/oss-writing/scripts/prose.mjsreports zero findings on all three files.Known gaps
The markers cover this one file. The other 24 unmarked files under
skills/and the five tracked root files carry no evidence yet, and nothing gates a missing marker until the checker exists. Both are separate work.Affects