This repository contains no application code, no servers, and no user data. It is a set of Markdown instructions plus dependency-free Python scripts that read files from a local repository.
A vulnerability here means one of:
- a script that can be made to leak file contents it should not read (for example, printing a secret's value from a scanned repository)
- a script that can be made to write, delete, or modify files outside the directory it was pointed at
- an instruction in a mode file that could cause an AI agent to perform a destructive or security-reducing action without human approval
- a supply-chain issue: a dependency added where none is needed
- No network calls in any script. No telemetry, no analytics, no phone-home.
- No third-party dependencies. Standard library only, so there is no dependency supply chain.
- No secret values are ever printed by
scan_project.py— it reports file path, line number, and the pattern name only. That behaviour is intentional and a regression in it is a security bug. - No credential rotation, IAM change, or infrastructure modification is ever performed or recommended as an automatic action.
Report privately. Do not open a public issue for a leak or an unsafe instruction, since the report may describe an exploitable path.
Please include:
- what you did, step by step
- what you expected, and what happened instead
- the affected file and line
- the command output, with any real secret removed
You will get an acknowledgement, an assessment of severity, and a fix or a written explanation of why the behaviour is intended.
That is a finding about that repository, not this one. Do not paste the value anywhere — not in an
issue here, not in a message. Report it to the maintainers of the affected repository through their
private channel, and recommend rotation, because a committed credential must be considered compromised.
See references/mode-security.md for the checklist this project uses.
- The behaviour of the AI assistant you load this skill into.
- The security of a project you scanned with these tools.
- The correctness of your own planning documents.