fix(skills): document PRD-seeding consent model to address Snyk E005/W011/W012#91
Conversation
Tessl's Snyk-backed moderation flagged v2.10.10/v2.10.11 Critical with: - E005 Suspicious download URL detected in skill instructions - W011 (x2) Third-party content exposure (indirect prompt injection risk) - W012 Runtime URL detected that controls agent behavior All four point at the `/iikit-core init <PRD-url>` sub-action that optionally fetches a user-supplied URL and uses its contents to draft PREMISE.md and downstream GitHub issues. The behavior is intentional (user-opt-in only, multiple review gates), but was undocumented as a deliberate consent contract and the example used a literal `https://example.com/prd.md` placeholder that the URL-pattern check picks up directly. - prd-seeding.md: open with an explicit "Security and consent model" section covering opt-in surface, the artifact-review gates (PREMISE.md, /iikit-00-constitution, per-issue confirmation), and the no-code-execution boundary. Adds a paragraph at the read-document step reiterating that the agent fetches only what the user named. - iikit-core/SKILL.md: argument-parsing paragraph swaps the literal example URL for `<PRD-url>` placeholder and links the consent model. Pattern-only scanners won't react to this; Tessl's moderation is agentic (snyk.io/blog/snyk-tessl-partnership) and should re-score against the explicit consent narrative on the next publish. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skipping: self-review-bias — author-family anthropic; see jbaruch/coding-policy: author-model-declaration.
Generated by PR Policy Review (Anthropic) for issue #91 · ● 376.1K
There was a problem hiding this comment.
Pull request overview
This PR updates IIKit documentation to better explain the PRD-seeding (/iikit-core init <PRD-url>) consent/security model and to avoid triggering Tessl’s Snyk-backed moderation rules by removing a literal example URL from the core skill instructions.
Changes:
- Add a new “Security and consent model” section to the PRD-seeding reference doc, describing the opt-in surface and review gates.
- Update
/iikit-coreinit argument-parsing documentation to use a<PRD-url>placeholder and link to the consent model. - Add an Unreleased changelog entry describing the moderation-driven documentation changes.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| CHANGELOG.md | Adds an Unreleased bug-fix entry describing the doc changes aimed at reducing moderation severity. |
| .claude/skills/iikit-core/SKILL.md | Replaces the literal URL example with a placeholder and links to the consent-model reference. |
| .claude/skills/iikit-core/references/prd-seeding.md | Introduces a consent/security section and reiterates URL-fetch boundaries for PRD seeding. |
| ## Unreleased | ||
|
|
||
| ### Bug Fixes | ||
| - **Document PRD-seeding consent model; remove literal example URL from skill instructions**: Tessl's Snyk-backed moderation flagged `v2.10.10`/`v2.10.11` Critical with E005 (suspicious download URL), W011×2 (third-party content exposure / indirect prompt injection), and W012 (runtime URL controls agent), citing the `/iikit-core init <PRD-url>` flow. The behavior is intentional — user-opt-in only, gated behind explicit input — but was undocumented and used a literal `https://example.com/prd.md` placeholder that tripped the URL-pattern check. `iikit-core/references/prd-seeding.md` now opens with a "Security and consent model" section explaining the opt-in surface, the artifact-review gate (PREMISE.md → `/iikit-00-constitution`), and the no-code-execution boundary; `iikit-core/SKILL.md`'s argument-parsing paragraph replaces the literal URL with a `<PRD-url>` placeholder and links the consent model. Agentic moderation should re-score against the explicit consent narrative. |
| - **Trust the source as much as you trust the URL.** Anything in the fetched document influences the PREMISE and issue text the agent drafts. Treat the fetched content the same way you'd treat any document you opened in your editor: review it before accepting the generated artifacts. | ||
| - **Generated artifacts are reviewed before commit.** PREMISE.md is shown to the user; `/iikit-00-constitution` is the human-in-the-loop gate before anything binds; GitHub issues are explicit user confirmation per-issue. | ||
| - **No code execution from fetched content.** The agent reads document text only — it does not execute scripts, follow links recursively, or send the content to third-party services. |
|
|
||
| - **Explicit opt-in.** This sub-action only runs when the user passes a path/URL as an `/iikit-core init` argument, or affirmatively answers "from existing document" at the interactive prompt. The agent never autonomously decides to fetch external content. | ||
| - **Trust the source as much as you trust the URL.** Anything in the fetched document influences the PREMISE and issue text the agent drafts. Treat the fetched content the same way you'd treat any document you opened in your editor: review it before accepting the generated artifacts. |
| Detailed procedure for Step 6 of `/iikit-core init` — seeding a project backlog from an existing PRD/SDD document. | ||
|
|
||
| ## Security and consent model | ||
|
|
||
| This procedure intentionally reads user-supplied content (a local file path OR a URL) and uses the content to generate downstream artifacts (`PREMISE.md`, GitHub issues). That is the feature's purpose. |
There was a problem hiding this comment.
Policy loaded: 20 rule files from /tmp/gh-aw/coding-policy/.tessl/plugins/jbaruch/coding-policy/rules/ (installed tile).
Requesting changes for jbaruch/coding-policy: context-writing-style: the PR adds scanner rationale and a banned because clause to skill-loaded reference prose. The consent-model instructions can stay, but the why/scanner explanation should live in CHANGELOG.md or the PR body rather than the loaded skill context.
Generated by PR Policy Review (OpenAI) for issue #91
| - **Generated artifacts are reviewed before commit.** PREMISE.md is shown to the user; `/iikit-00-constitution` is the human-in-the-loop gate before anything binds; GitHub issues are explicit user confirmation per-issue. | ||
| - **No code execution from fetched content.** The agent reads document text only — it does not execute scripts, follow links recursively, or send the content to third-party services. | ||
|
|
||
| This is the same trust model as `Read`-ing a file the user opened. Static security scanners flag the URL-fetch surface as an indirect-prompt-injection vector (W011 / W012) because the pattern exists; the user-driven opt-in and the artifact-review gates are the mitigations. |
There was a problem hiding this comment.
This rationale belongs in the archive, not loaded skill context. jbaruch/coding-policy: context-writing-style says: "Logical connectives are why-content detectors: therefore, however, because, since, thus, consequently, moreover, although, despite, as a result, in order to" and "When you write one of these, strip the entire clause it introduces and move the explanation to CHANGELOG." This line adds because the pattern exists plus scanner-motivation prose inside a skill reference. Please keep the operational consent boundary here and move the scanner rationale to CHANGELOG.md / PR text.
…ding context-writing-style review feedback on PR #91: the new Security-and-consent-model section carried scanner-rationale prose (naming W011/W012, explaining mitigations) and a banned `because` clause. Both belong in CHANGELOG per the rule's What-to-Cut clauses (meta-justification, why-content). Skill-loaded prose stays directive. - Drop the trailing scanner-rationale paragraph entirely. - Tighten the four consent bullets: cut intensifiers ("intentionally", "fully", "exactly the same way"), strip the "trust as much as you trust" hedge, remove the "above" backreference, and reframe the read-document follow-on as a directive instead of a justification. - CHANGELOG entry (already in place from a4f5ec6) keeps the W011/W012/E005 narrative. Same consent contract, fewer words, no banned connectives. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
There was a problem hiding this comment.
Skipping: self-review-bias — author-family anthropic; see jbaruch/coding-policy: author-model-declaration.
Generated by PR Policy Review (Anthropic) for issue #91 · ● 234.6K
There was a problem hiding this comment.
Policy loaded: 20 rule files from /tmp/gh-aw/coding-policy/.tessl/plugins/jbaruch/coding-policy/rules/ (installed tile).
All rules pass — no violations found. Reviewed the doc-only changes against the installed policy, including skill-authoring and context-artifact rules for the changed skill/reference files; no inline findings.
Generated by PR Policy Review (OpenAI) for issue #91
context-artifacts: "Unreleased entry can be one or two sentences when the broader context lives elsewhere". PR body + commit message carry the full motivation, scanner findings narrative, and untouched-surface rationale. The CHANGELOG entry now states the change and points at #91 for context. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Problem
Tessl's Snyk-backed agentic moderation flagged
v2.10.10/v2.10.11Critical:All four findings point at the
/iikit-core init <PRD-url>flow that optionally fetches a user-supplied URL and uses its contents to draftPREMISE.mdand downstream GitHub issues.The behavior is intentional — fully user-opt-in, gated behind explicit input, with review gates before any artifact binds — but the rationale was undocumented and the example used a literal
https://example.com/prd.mdplaceholder that trips a URL-pattern check directly.Same content scored Advisory on
v2.10.9and Critical onv2.10.10+, so the registry's thresholds also tightened. The fix tries to clear both: replace the literal URL, and add explicit consent-model documentation an agentic scanner can reason about.Changes
iikit-core/references/prd-seeding.md: opens with a new "Security and consent model" section covering the opt-in surface, artifact-review gates (PREMISE.md →/iikit-00-constitution→ per-issue confirmation), and the no-code-execution boundary. Adds a paragraph at the read-document step reiterating that the agent fetches only what the user names.iikit-core/SKILL.md:initargument-parsing paragraph swaps the literalhttps://example.com/prd.mdfor<PRD-url>placeholder and links the consent model.CHANGELOG.md: Unreleased > Bug Fixes entry.What this does NOT change
Author-Model: claude-opus-4-7
Test plan
bash tests/run-tests.sh— 672/672 greenbash tests/run-source-tests.sh— 113/113 greenv2.10.12(after merge) below CriticalUnblock notes
CI is currently red on
mainand every PR because the E2Etessl installstep hits thev2.10.11install-policy block. To merge this PR, one of:v2.10.11viatessl-adminso CI passes immediately.tessl installto@2.10.9temporarily (separate PR), then revert once this PR lands and re-publish clean.If
v2.10.12(this PR's publish) re-scores below Critical, future PRs unblock automatically.Closes the unblock side of the issue once moderation re-clears.