Close residual SkillStore audit gaps and publish a fresh assessment

[cagdasyurekli]

Context

SkillStore audit v1 assessed source commit 6fd2c55 and reported four confirmed concerns plus a capped static review:

• https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/1

Current origin/main is v0.12.0 at 165fd10. PR #112 already closed or materially reduced several findings:

• provider children now receive an allowlisted environment with exact-name opt-ins;
• verifier children run from an env -i baseline with exact-name opt-ins passed through a private descriptor;
• packaged personas no longer present themselves as system instructions or use You are authority framing;
• whole-worktree provider readability and transmission consent are documented explicitly.

Do not regress these controls or duplicate their completed implementation.

Remaining work

• Design and implement a structured-argv verification path for ordinary checks. If compatibility requires retaining shell commands, make shell execution an explicit, separately documented mode with the same minimal environment and clear confirmation requirements for secrets or network access.
• Add a provider-free dry-run transmission preview that reports the resolved disposable-worktree root and a bounded, privacy-safe manifest or digest of worker-readable paths before launch. It must not contact AGY or the provider.
• Review and record dispositions for the 324 static analyzer matches omitted by the capped 400/724 review, or reduce generated, bundled, or reference content from the submitted audit corpus with a documented rationale.
• After the code and review work is complete, update the SkillStore listing from the old 6fd2c55 source and request a fresh immutable assessment for the exact published commit.

Acceptance criteria

• Freeze user journeys, acceptance tests, and authority/privacy constraints before implementation; use a suitable planning expert and a different independent final reviewer as required by repository policy.
• Existing provider and verifier environment-isolation regression coverage remains green.
• Structured verification covers positive and negative cases, including argument boundaries, unsupported shell constructs, secret-variable absence, exact-name opt-in, and network/credential confirmation behavior.
• Dry-run preview is deterministic, bounded, excludes file contents and secret values, accurately represents the worker-readable worktree, and provably performs no provider launch.
• Update SECURITY_AND_COMPATIBILITY.md, SKILL.md, the relevant REPO_MAP row, and durable lessons only where behavior or trust claims change.
• Run the owning focused suites, ground-truth checks when AGY-facing behavior or claims change, one stable full scripts/ci-offline.sh run, git diff --check, and agents-md-auditor after material changes.
• Obtain separate action-time approval before updating SkillStore or requesting the new audit; record the resulting exact source commit and audit URL.
• The new audit clearly distinguishes inherent external-provider transmission from remediable scope-preview and consent controls.

References

• SkillStore audit v1: https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/1
• Boundary hardening PR: Harden skill execution boundaries and publish metadata #112
• Current audited-source replacement target: 165fd10

[cagdasyurekli]

Audit v2 reconciliation

SkillStore audit v2 assessed source commit 3d8f947:

https://skillstore.io/skills/cagdasyurekli-agy-worker/audits/2

The v2 evidence changes the current reconciliation as follows:

• The only confirmed semantic finding is the inherent medium-severity risk that approved repository content leaves the local host. Existing per-repository approval and pre-launch disclosure remain mandatory. Optional filesystem-enforced narrow read scopes are tracked separately in Add filesystem-enforced provider read scopes with a filtered staging workspace #111.
• Explicit shell verification remains a remediation item. This issue therefore retains structured argv as the default path and explicit, acknowledged shell execution as the compatibility escape hatch.
• The capped static review is now 400/766, leaving 366 matches without adjudication. This supersedes the v1 count of 324 omitted matches for current acceptance.
• A fresh audit is not complete until those 366 matches have recorded dispositions or the submitted corpus is reduced with a justified, reviewed boundary.

Do not close this issue from the audit v2 risk reduction alone. Closure still requires verified implementation evidence, the static-review disposition, an exact published source commit, and readback of the resulting fresh SkillStore assessment.

[cagdasyurekli]

Fresh exact-commit assessment requested for v0.13.0 source 48ab30f via SkillStore submission c4c54634-87f1-4859-ba1d-87e5293891db and marketplace PR #3245. The report binds version 0.13.0 and the exact source, but automatic publication remains disabled: 400/889 static matches were reviewed, with 396 false positives, 4 confirmed findings, and 489 omitted matches. It also retains the external-provider transmission residual, legacy shell-verification concern, caller-selected verifier executable concern, and a supported-tool metadata mismatch. This issue therefore remains open; no full audit-closure claim is made.