ch040602/skill-vaccine

ch040602 资料

最近记录的来源活动: 2026年7月7日 04:49

SkillsMP 收录数据更新: 2026年10月17日 00:09

已收集 skills: 68

GitHub 星标: 0
GitHub Forks: 0

仓库 README

仓库 README 来源：README.md

查看 README 源文件

展开完整 README

# Skill Vaccine **Scan-gated safety for Agent Skills before they reach Codex, Claude Code, CI, or a registry.** <p align="center"> <img src="docs/assets/readme-teaser.svg" alt="Skill Vaccine teaser: scan-gated Agent Skill safety with fixture benchmark and install-gate pipeline" width="900"> </p> <p align="center"> <img src="docs/assets/skill-vaccine-teaser.svg" alt="Skill Vaccine scan gate showing static analysis, semantic review, verdicts, trust tiers, and safe installation" width="900"> </p> `agent-skills` · `skill-security` · `prompt-injection` · `supply-chain-security` · `sarif` · `codex` · `claude-code` Skill Vaccine is a local scan gate for Agent Skill packages. It combines one deterministic command-line interface (CLI), `skill-vaccine`, with one optional Agent Skill adapter, `skills/skill-vaccine-review`, so teams can block risky packages in Continuous Integration (CI), review third-party skills with structured evidence, and install only after a scan-backed verdict. ## Skill Review Becomes an Install Gate Skill Vaccine is built around a concrete admission decision: should this Agent Skill be allowed into a workstation, CI run, registry, or marketplace review queue? | Signal | Current state | | --- | --- | | CLI verdicts | `approved`, `conditional`, `rejected` | | Trust tiers | `unvetted`, `local-only`, `reviewed`, `trusted` | | Machine outputs | text, JavaScript Object Notation (JSON), Static Analysis Results Interchange Format (SARIF), manifest suggestions, LLM review packets | | Static scope | `SKILL.md`, referenced Markdown, Python, shell, PowerShell, batch, and JavaScript helper scripts | | Agent-assisted boundary | The reviewed skill's code stays unexecuted; the agent reviews a CLI-generated evidence packet. | ## Fixture Benchmark The bundled benchmark is intentionally a smoke contract for rule coverage, not a broad scanner-quality claim. | Metric | Value | | --- | ---: | | Cases | `57` | | Benign controls | `14` | | Risky cases | `43` | | Precision / recall / F1 | `1.0 / 1.0 / 1.0` | | False positive rate | `0.0` | | Rule coverage | `1.0` | | Static findings | `196` total: `47` medium, `64` high, `85` critical | ## Contents - [Skill Review Becomes an Install Gate](#skill-review-becomes-an-install-gate) - [Fixture Benchmark](#fixture-benchmark) - [Why](#why) - [What This Is](#what-this-is) - [Choose a Path](#choose-a-path) - [Gate Pipeline](#gate-pipeline) - [Install](#install) - [npm Package Management](#npm-package-management) - [Quick Start](#quick-start) - [Outputs](#outputs) - [Review Then Install](#review-then-install) - [Agent-Assisted Review](#agent-assisted-review) - [Policy Profiles](#policy-profiles) - [Integrations](#integrations) - [Documentation](#documentation) - [Research Basis](#research-basis) - [Contributing](#contributing) - [Development](#development) ## Why Agent skills can hide risk in natural-language instructions, permission claims, helper scripts, and registry metadata. Skill Vaccine provides a local static review layer with optional semantic-routing contracts, admission verdicts, trust tier metadata, SARIF output, and benchmark fixtures. Current checks cover: - prompt injection, secret exfiltration, hidden behavior, and governance evasion - overbroad discovery or selection language in `SKILL.md` - risky behavior in `SKILL.md`, referenced Markdown docs, and helper scripts across Python, shell, PowerShell, batch, and JavaScript fixtures - missing or mismatched permission/capability declarations - registry metadata provenance gaps - cross-file hidden capabilities and cross-skill risk graph links - semantic review coverage gaps and provider-neutral Layer 2 / Layer 3 contracts ## What This Is Skill Vaccine is one product with two entry points: | Entry point | Purpose | | --- | --- | | `skill-vaccine` CLI | Deterministic local scans, CI gates, SARIF output, manifests, benchmark checks, and evidence packet generation. | | `skills/skill-vaccine-review` | Codex/Claude Code adapter that asks the host agent to review a safe packet generated by the CLI. | The adapter does not replace the CLI. It wraps CLI evidence for semantic review and keeps the reviewed skill's code unexecuted. ## Choose a Path | Security job | Start with | | --- | --- | | Local triage before installing a skill | `skill-vaccine scan path\to\skill --format text` | | Install only after a passing scan | `skill-vaccine install path\to\skill --fail-on high` | | CI or PR gate with SARIF | [GitHub Action](docs/github-action.md) and [pre-commit](docs/pre-commit.md) | | Registry or marketplace intake | [Host profiles](docs/host-profiles.md), [Trust tiers](docs/trust-tiers.md), and [Registry lifecycle risks](docs/registry-lifecycle-risks.md) | | Rule tuning and suppressions | [Rules](docs/rules.md), [Config](docs/config.md), and [Suppressions](docs/suppressions.md) | | Cross-file hidden behavior review | [Cross-file consistency](docs/cross-file-consistency.md) and [Risk graph](docs/risk-graph.md) | | Agent-assisted semantic review | [Semantic Layer 2](docs/semantic-layer2.md), [Jury Layer 3](docs/jury-layer3.md), and [`skills/skill-vaccine-review`](skills/skill-vaccine-review) | ## Gate Pipeline ```text parse package -> scan instructions and helpers -> infer capabilities -> assign verdict and trust tier -> emit JSON/SARIF/evidence -> install only if gate passes ``` | Gate | Artifact | | --- | --- | | Static rules | [`src/skill_vaccine/data/rules.toml`](src/skill_vaccine/data/rules.toml), [`docs/rules.md`](docs/rules.md) | | Capability inference | [`docs/capabilities.md`](docs/capabilities.md) | | Verdict and trust tier | [`docs/verdicts.md`](docs/verdicts.md), [`docs/trust-tiers.md`](docs/trust-tiers.md) | | Host policy | [`docs/host-profiles.md`](docs/host-profiles.md), [`docs/config.md`](docs/config.md) | | Machine-readable review | JSON/SARIF output, [`docs/semantic-layer2.md`](docs/semantic-layer2.md), [`docs/jury-layer3.md`](docs/jury-layer3.md) | | Public README review | [`docs/mdpr-readme/`](docs/mdpr-readme/) | ## Install From npm after the package is published: ```powershell npm install -g @cchsh/skill-vaccine skill-vaccine --help ``` From a checkout: ```powershell python -m pip install -e . skill-vaccine --help ``` Or run directly from the source tree through the bundled Node wrapper: ```powershell node bin\skill-vaccine.js scan tests\fixtures\benign_skill ``` For local Codex use, keep one source of truth by linking the installed skill to this checkout: ```powershell New-Item -ItemType Junction ` -Path "$env:USERPROFILE\.codex\skills\skill-vaccine-review" ` -Target ".\skills\skill-vaccine-review" ``` Do not maintain a separate copied skill folder unless you intentionally want it to diverge from the version that is committed and pushed. ## npm Package Management The npm package identity is `@cchsh/skill-vaccine`, and it exposes the `skill-vaccine` binary from `bin/skill-vaccine.js`. The package is configured for public scoped publication with `publishConfig.access = public`. Registry status checked on 2026-06-26: - `npm view @cchsh/skill-vaccine ...` returned `404 Not Found`, so the package name is not published on npm yet. - `npm whoami` returned `E401`, so this workstation is not currently authenticated to npm. - `npm pack --dry-run` passes and includes the CLI wrapper, Python package, docs, research summaries, and `skills/skill-vaccine-review`. Before publishing: ```powershell npm login npm whoami npm pack --dry-run npm publish --access public npm view @cchsh/skill-vaccine name version repository.url homepage --json ``` Until the npm package is published, install from a checkout with `python -m pip install -e .` or run the bundled wrapper directly with `node bin\skill-vaccine.js ...`. ## Quick Start Scan a skill: ```powershell skill-vaccine scan path\to\skill --format text skill-vaccine scan path\to\skill --format json skill-vaccine scan path\to\skill --format sarif --fail-on high ``` Scan and install one local Agent Skill package into Codex only if it passes the install gate: ```powershell skill-vaccine install path\to\skill --format json skill-vaccine install path\to\skill --skills-dir "$env:USERPROFILE\.codex\skills" --format json ``` Use a JSON or TOML config: ```powershell skill-vaccine scan path\to\skill --config skill-vaccine.json --format json skill-vaccine scan path\to\skill --config skill-vaccine.toml --format json ``` Inspect related contracts and reports: ```powershell skill-vaccine manifest suggest path\to\skill skill-vaccine semantic schema skill-vaccine semantic review path\to\skill --provider fake skill-vaccine jury schema skill-vaccine jury review path\to\skill --provider fake skill-vaccine llm schema skill-vaccine llm prompt path\to\skill --target codex --format markdown skill-vaccine llm validate llm-response.json skill-vaccine graph path\to\skills skill-vaccine eval tests\fixtures\benchmark\labels.json skill-vaccine telemetry schema skill-vaccine trust profiles skill-vaccine trust host-profiles ``` ## Outputs Every scan reports: - `max_severity`: highest active finding severity - `verdict`: `approved`, `conditional`, or `rejected` - `required_trust_tier`: `unvetted`, `local-only`, `reviewed`, or `trusted` - `inferred_capabilities`: capability IDs derived from findings and declarations - `findings`: rule IDs, evidence, capability IDs, lifecycle stage, and suppression metadata JSON and SARIF are intended for CI, registry intake, and review automation. Text output is for local triage. ## Review Then Install `skill-vaccine install` is the local install path for installing another Agent Skill. It scans exactly one local skill package, reads the skill name from `SKILL.md` frontmatter, and copies it into the Codex skills directory only when the scan is below the install threshold. The default threshold is `high`, so `high` and `critical` findings block installation. CLI path: ```powershell # 1. Inspect the candidate skill without installing it. skill-vaccine scan path\to\candidate-skill --format text # 2. Install only if the scan gate passes. skill-vaccine install path\to\candidate-skill --format json # 3. Use a stricter local policy when desired. skill-vaccine install path\to\candidate-skill --fail-on medium ``` Explicit Codex skills directory: ```powershell skill-vaccine install path\to\candidate-skill ` --skills-dir "$env:USERPROFILE\.codex\skills" ` --format json ``` Agent Skill path: ```text Use $skill-vaccine-review to review path\to\candidate-skill and install it only if it passes. ``` The adapter first asks the CLI to create a safe evidence packet with `skill-vaccine llm prompt ...`. After semantic review, it uses `skill-vaccine install ...` for the actual installation. The agent should not copy, link, execute, or run install scripts from the candidate skill manually. The install command does not fetch remote repositories, execute reviewed scripts, run package installers, or overwrite an existing installed skill. A blocked result returns `blocked: true`, `installed: false`, and keeps the candidate skill out of the Codex skills directory. ## Agent-Assisted Review Skill Vaccine has two explicit modes. | Mode | Use it when | What runs | LLM behavior | | --- | --- | --- | --- | | CLI-only mode | You need deterministic local scans, install gates, CI gates, SARIF, benchmarks, or registry intake. | `skill-vaccine scan`, `skill-vaccine install`, `semantic review --provider fake`, `jury review --provider fake`. | No LLM call. No network. No reviewed skill code execution. | | Agent-assisted review | You want Codex or Claude Code to judge intent, permission justification, covert behavior, cross-file consistency, or whether a reviewed skill should be installed. | `skills/skill-vaccine-review` runs `skill-vaccine llm prompt ...`; for installation it runs `skill-vaccine install ...` after review. | The host agent LLM reviews the packet in-session. The CLI still does not call a model API itself. | Generate a review packet directly: ```powershell skill-vaccine llm schema skill-vaccine llm prompt path\to\skill --target codex --format markdown skill-vaccine llm prompt path\to\skill --target claude-code --format json skill-vaccine llm validate llm-response.json ``` `skill-vaccine llm schema` prints the JSON contract for both the prompt packet and the expected LLM response. `skill-vaccine llm prompt` embeds the same `response_schema` in every JSON packet and prints it in Markdown output so Codex or Claude Code can return machine-checkable review results. `skill-vaccine llm validate` checks a saved LLM response artifact against that contract and exits non-zero when required fields, enum values, score ranges, or array fields are invalid. Use the installable Agent Skill adapter from this repo: ```text skills/skill-vaccine-review ``` The adapter is intentionally small: it tells Codex or Claude Code to collect local static evidence, avoid executing reviewed skill code, preserve critical static findings, and return structured JSON with semantic task results. This is the layered pattern: fast static screening first, semantic review only when judgment is needed. ## Policy Profiles Trust tiers describe the minimum operator boundary needed for a skill. Host profiles choose scan defaults for a specific environment. Built-in host profiles: | Profile | Default threshold | Extra checks | Use case | | --- | --- | --- | --- | | `local` | `critical` | none | developer workstation triage | | `ci` | `high` | none | pull request and build gating | | `registry` | `medium` | semantic routing, metadata audit | registry intake | | `marketplace-review` | `low` | semantic routing, metadata audit | strict marketplace review | Explicit CLI flags override config values; config values override host profile defaults. ## Integrations GitHub Actions: ```yaml - uses: ./ with: path: . fail-on: critical sarif-file: skill-vaccine-review.sarif ``` pre-commit: ```yaml repos: - repo: local hooks: - id: skill-vaccine-review name: Skill Vaccine entry: skill-vaccine scan . language: python pass_filenames: false args: [--fail-on, high] ``` ## Documentation - [Rules](docs/rules.md) - [Capabilities](docs/capabilities.md) - [Config](docs/config.md) - [Host profiles](docs/host-profiles.md) - [Trust tiers](docs/trust-tiers.md) - [Verdicts](docs/verdicts.md) - [Suppressions](docs/suppressions.md) - [Registry lifecycle risks](docs/registry-lifecycle-risks.md) - [Cross-file consistency](docs/cross-file-consistency.md) - [Risk graph](docs/risk-graph.md) - [Metadata audit](docs/metadata-audit.md) - [Semantic Layer 2](docs/semantic-layer2.md) - [Jury Layer 3](docs/jury-layer3.md) - [Telemetry schema](docs/telemetry.md) - [Benchmark](docs/benchmark.md) - [GitHub Action](docs/github-action.md) - [pre-commit](docs/pre-commit.md) - [Release](docs/release.md) - [Contributing](CONTRIBUTING.md) ## Research Basis Skill Vaccine is grounded in the local research synthesis at [research/skill-vaccine-research-synthesis.md](research/skill-vaccine-research-synthesis.md). Korean paper summaries are indexed in [research/paper_summaries/index.md](research/paper_summaries/index.md). The implementation maps ideas from SkillSieve, SkillGuard, SkillProbe, Skilldex, OpenSkillEval, SkillsBench, EvoSkills, SKILL.md semantic-attack work, and broader agent-skill landscape papers into static rules, semantic-routing contracts, jury protocol scaffolding, evaluation fixtures, and admission-policy metadata. ## Contributing See [Contributing](CONTRIBUTING.md) for setup, validation, benchmark update rules, npm release checks, and safe skill-review contribution rules. ## Development Run tests: ```powershell python -m pytest python -m compileall -q src tests ``` Build distribution artifacts: ```powershell python -m pip wheel . --no-deps --no-build-isolation -w .codex\review-driven-development\artifacts\wheel-smoke npm pack --dry-run ``` Current benchmark smoke metrics on the bundled fixture set: - cases: `57` - benign controls: `14` - risky cases: `43` - precision: `1.0` - recall: `1.0` - F1: `1.0` - F2: `1.0` - FPR: `0.0` - suspicious rate: `0.7544` - escalation rate: `0.7193` - rule coverage: `1.0` These are contract-smoke metrics for the MVP fixture suite, not broad scanner-quality claims.

正在加载仓库 README…

这个仓库中的 skills

软件开发工程师其他计算机职业信息安全分析师综合办公文员

6 个职业分类 · 已分类 100%

软件开发工程师

Covers paraphrased agent-context priority manipulation in project workflows.

原文语言：英语

2026-07-07

已展示 40 / 68 个已收集 Skill。

用 AI 助手安装

复制这段 Prompt，发给你正在使用的 AI 助手。

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/ch040602/skill-vaccine.