Skip to content

SECURITY.md

Latest commit

 

History

History
84 lines (56 loc) · 4.79 KB

SECURITY.md

File metadata and controls

84 lines (56 loc) · 4.79 KB
Raw

Security Policy

Supported versions

Version Supported
1.x Yes

Reporting a vulnerability

Do not open a public GitHub issue for security vulnerabilities.

Email: baagad.ai@gmail.com

Include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Any suggested fix

You'll receive a response within 48 hours. If the issue is confirmed, a patch will be released and you'll be credited unless you prefer otherwise.

Security model

content-wand is a Claude Agent Skill — it runs inside Claude's context window. The main security surfaces are the Writing Style files and the URL/web content processing pipeline.

Writing Style files (~/.claude/content-wand/styles/)

  • Opt-in only — files are never written without explicit user confirmation
  • Schema-validated on read — any file with unknown keys is rejected outright, not parsed; version 1.2 schema
  • String-field content scan — after structural validation, string values in opening_patterns, structural_patterns, taboo_patterns, and aspirational_notes are scanned for behavioral injection patterns (persona hijacking, file access directives, output manipulation directives). If detected: file is rejected; user is shown a plain-language message only.
  • Never stores raw content — only extracted patterns (tone axes, style descriptors); never raw writing samples, URL-fetched text, credentials, or personal information
  • Global user scope — stored at ~/.claude/content-wand/styles/ in the user's home directory, not project-scoped; inherits standard OS user-level access controls
  • User-deletable — deleting a style file and its entry in config.json is the complete reset mechanism

Humanizer security

The humanizer sub-skill receives content generated by platform-writer and repurpose-transformer — both TRUSTED sources (generated within this skill, not from external content). No new injection surface is introduced by the humanizer. Pattern replacements change HOW content is expressed, never WHAT it says; meaning changes are explicitly prohibited.

Known Architectural Constraints

The Lethal Trifecta

content-wand simultaneously satisfies three properties that, in combination, create a structurally exploitable attack surface for prompt injection:

  1. Access to private data — reads and writes ~/.claude/content-wand/styles/ (personal Writing Style data); writes files to content-output/
  2. Exposure to untrusted content — fetches content from user-supplied URLs and WebSearch results
  3. Ability to communicate externally — uses WebFetch and WebSearch

When all three are present, a sufficiently sophisticated prompt injection in fetched content could in theory instruct the skill to read and exfiltrate Writing Style data. This is an architectural property of content-wand's design, not a flaw that can be patched away.

Mitigations in place:

  • Trust boundary model in SKILL.md — explicit rules for what external content can and cannot control
  • Behavioral injection detection in content-ingester — heuristic scanning of fetched content
  • Security sections in all sub-skills — reinforce that raw_text is data, not instructions
  • Schema validation + string field scanning in writing-style-extractor READ mode
  • Delimiter guard preventing fake block injection
  • Humanizer receives only trusted content (platform-writer / repurpose-transformer output)

Mitigations that are NOT in place (by design):

  • Cryptographic content signing (would require external infrastructure)
  • LLM-independent deterministic injection detection (not possible in a pure markdown skill)
  • Full trifecta elimination (would require removing core features)

User recommendation: Treat content-wand like any tool that processes untrusted web content. Do not use it on URLs you do not trust. Writing Style files live in your home directory under ~/.claude/ — they are personal to your user account and are not exposed to version control by default.

What this skill does NOT do

  • It does not make network requests except via Claude's built-in WebFetch/WebSearch tools (used for URL fetching and topic research)
  • It does not execute code during skill operation. The repository contains utility scripts (assets/generate-pdf.js, assets/launch-slideshow.html) for manual use only — these are not loaded or executed by Claude.
  • It does not access files outside ~/.claude/content-wand/ and content-output/ in the current project directory
  • It does not transmit data to external services

Recommended .gitignore entry

If you save content outputs in a version-controlled project:

content-output/

Writing Style files live in ~/.claude/ — they are not in your project directory and do not need a .gitignore entry.