fix(construct): sync §3.3 name refinement to "Security by Design"#6
Merged
Conversation
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
UnbreakableMJ
added a commit
that referenced
this pull request
Jun 21, 2026
…mmitted drift) The committed .zip/.skill shipped v1.24 (§3.3 "Hardened Security") while the committed SKILL.md source was already v1.25 (§3.3 "Security by Design") — commit b8d3f02 (#6) updated the source but not the bundle, so consumers installing from the zip got stale text. Rebuild both bundles from the current source; no content authored here. Full drift sweep now clean across all root and Grok skills. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
UnbreakableMJ
added a commit
that referenced
this pull request
Jul 24, 2026
Fourth in the sequence after 6a01665 (missing-pkg), 0c8a6ff (cli-preference), and a6aaa59 (cli-shell). Unlike those three, this is a design/authoring skill rather than one the agent executes -- but grounding it against the real environment surfaced a correctness bug in shipped reference code. Flagship: the canonical agent-detection code failed to detect the agent reading it. agent-env-detection.md's is_truthy matched only "1"/"true", but real harnesses export descriptive strings -- this session runs under AI_AGENT=claude-code_2-1-218_agent. So is_truthy("AI_AGENT") returned false and the CLI never entered the agent profile; it only lucked into JSON via the non-TTY fallback, silently skipping quiet mode, pagination, and confirmation friction-reduction. The AI_AGENT=1 value was echoed as fact in the SKILL.md §4 table, the §2 sub-headers, and audit item #6, so a CLI could pass an audit run with AI_AGENT=1 while failing under production Claude Code. Fix: detection is presence-based. Two predicates replace is_truthy -- is_present (set and non-empty, any value) for the agent-presence vars (AI_AGENT, AGENT, CLAUDECODE, CURSOR_AGENT, GEMINI_CLI, TRAE_AI_SHELL_ID), and is_truthy_value (set and not ""/0/false) for CI, which also fixes CI=1 being missed by the old == "true" check. Both predicates were compiled and unit- tested, including the AI_AGENT-string case. §4 table, §2 headers, worked example, and a new §7 anti-pattern all updated and grounded in the observed values. Four smaller local-host retargets: - Audit by running, not reading. §9 gains a behavioral lead-in and item #6 is reworded: set the host's actual AI_AGENT value and observe that describe reports profile=agent. A source read misses exactly the bug above. - No-clobber scaffolding. §2 gains a read-before-write rule: context files (AGENTS.md/CLAUDE.md/...) are merged and proposed, never overwritten -- the consent-before-durable principle from missing-pkg, applied to file creation. - Runnable, synced hints. tips-thinking's MISSING_DEPENDENCY formula moves from the superseded nix-shell -p to missing-pkg's nix run nixpkgs#<pkg>, and the PERMISSION_DENIED example drops sudo chown (an agent has no TTY for the prompt) for a non-privileged XDG path, with the principle stated: a hint an agent cannot run is a bad hint. - Sibling cross-refs. §11 notes all three siblings are now local-host aware and routes to them for provisioning / shell / tool choice. New reference local-host-authoring.md and a new SKILL.md §12 tie it together. Description unchanged at 985 (cap 1000). Bundle rebuilt at 11 files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Secure / Security By Design→Security by DesigninSKILL.mdandreferences/CHANGELOG.mdTest plan
grep "§3.3" spacecraft-standard/SKILL.md→ showsSecurity by DesignSecure / Security By Designremains🤖 Generated with Claude Code