3 Commits

• fix: sanitize subprocess call in runner.py (#2149)

  * fix: V-001 security vulnerability
  
  Automated security fix generated by OrbisAI Security
  
  * fix: sanitize subprocess call in runner.py
  
  The runner
  
  * fix: address PR review comments on V-001 allowlist and test coverage
  
  Remove dangerous interpreters (python, python3, node, curl, wget) from
  ALLOWED_SETUP_EXECUTABLES — they can execute arbitrary code via argument
  flags and are not needed for sandbox setup. Rewrite test_invariant_runner
  to call _setup_sandbox directly instead of spawning runner.py as a
  subprocess (which had no __main__ entrypoint and never exercised the fix).
  
  Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

  OrbisAI Security · 2026-06-15 13:49:45 -04:00
  cf59d0d283
• docs: salvage focused stale PR contributions

  - add Vite and Redis pattern skills from closed stale PRs
  
  - add frontend-slides support assets
  
  - port skill-comply runner fixes and LLM prompt/provider regressions
  
  - harden agent frontmatter validation and sync catalog counts

  Affaan Mustafa · 2026-05-11 05:31:12 -04:00
  b39d2244cf
• feat(skills): add skill-comply — automated behavioral compliance measurement (#724)

  * feat(skills): add skill-comply — automated behavioral compliance measurement
  
  Automated compliance measurement for skills, rules, and agent definitions.
  Generates behavioral specs, runs scenarios at 3 strictness levels,
  classifies tool calls via LLM, and produces self-contained reports.
  
  Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
  
  * fix(skill-comply): address bot review feedback
  
  - AGENTS.md: fix stale skill count (115 → 117) in project structure
  - run.py: replace remaining print() with logger, add zero-division guard,
    create parent dirs for --output path
  - runner.py: add returncode check for claude subprocess, clarify
    relative_to path traversal validation
  - parser.py: use is_file() instead of exists(), catch KeyError for
    missing trace fields, add file check in parse_spec
  - classifier.py: log warnings on malformed classification output,
    guard against non-dict JSON responses
  - grader.py: filter negative indices from LLM classification
  
  Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

  Shimo · 2026-03-22 21:51:49 -07:00
  a2e465c74d