Add marketplace security audit gate for prompt injection & malicious functions - #7
Conversation
Adds scripts/audit-skills.mjs: a high-precision gate that scans every content package for prompt-injection/jailbreak signals (reusing the runtime prompt-injection-guard) and for malicious functions embedded in instructions (curl|sh RCE, dotenv/credential exfiltration, reverse shells, webhook beacons, hardcoded keys, obfuscated payloads). Packages with a high/critical finding fail the build; declared security/red-team fixtures may quote attack strings in examples without being blocked. Wired into the validate-content CI workflow and test suite. Audited all 77 current skills + playbooks/souls/integrations: none contain malicious content; the only signals are expected low-severity test fixtures in the prompt-injection-tester skill. https://claude.ai/code/session_01AenqS67aBze9evLvp3gqdH
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a325aa00d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (isFixture && (field === "examples" || field === "description" || field === "long_description") | ||
| && DEMOTE_IN_EXAMPLES.has(f.category)) { |
There was a problem hiding this comment.
Demoting injection findings for security fixtures in description/long_description creates a bypass: a package can self-tag as security and place instruction-override text in those fields, which drops severity below the block threshold and passes audit. Those fields are still fed into LLM prompts elsewhere (for example, package descriptions are embedded into the matching prompt in src/lib/match/match.functions.ts), so this effectively allows prompt-injection content through the gate outside examples.
Useful? React with 👍 / 👎.
| severity = worse(severity, sev); | ||
| } | ||
| } | ||
| const blocked = SEVERITY_RANK[severity] >= SEVERITY_RANK[REJECT_AT]; |
There was a problem hiding this comment.
The reject threshold is taken directly from AUDIT_REJECT_AT without validation, and the block check compares against SEVERITY_RANK[REJECT_AT]. If the env var is misspelled (for example critcal), the right-hand side is undefined, so the comparison is always false and no package is ever blocked. This silently disables the security gate in misconfigured CI or local runs.
Useful? React with 👍 / 👎.
|
@copilot resolve the merge conflicts in this pull request |
Co-authored-by: criptogus <128640021+criptogus@users.noreply.github.com>
Done — I merged |
What does this PR add?
A pre-publication security audit script that scans all marketplace packages (skills, playbooks, souls, integrations) for prompt-injection signals and malicious embedded functions before they can be released.
Type
Description
This PR introduces
audit-skills.mjs, a security gate that runs on every content PR and blocks packages containing:prompt-injection-guardso the gate and runtime stay in synccurl … | sh,wget | bash)rm -rf /,dd,mkfs)Key features:
high, can be set tocriticalviaAUDIT_REJECT_AT)security,red-team, oradversarialcan quote attack strings in examples without being blockedTesting:
CI Integration:
validate-content.ymlto runaudit:skillson every PR touching content or security-related filesaudit:skillsto package.jsonNotes for reviewers
The audit gate is intentionally conservative to avoid false positives:
lowif they target allowlisted hosts (docs)mediumorlow)The script reuses the production
inspectContentguard fromprompt-injection-guard.tsto ensure the gate and runtime detection stay synchronized.https://claude.ai/code/session_01AenqS67aBze9evLvp3gqdH