Repository navigation
Add SECURITY.md - #68
Merged
Merged
Conversation
Documents how to report a vulnerability and, more importantly, the trust model: Step 2 has the agent read and act on CLAUDE.md/CONTRIBUTING.md/ README.md/CODEOWNERS content from whatever repo /create-dev-loop is run against, so a hostile target repo could attempt to manipulate the generation process. Only run it against trusted repos.
This was referenced Jul 27, 2026
Closed
dmccoystephenson
added a commit
that referenced
this pull request
Aug 3, 2026
Documents how to report a vulnerability and, more importantly, the trust model: Step 2 has the agent read and act on CLAUDE.md/CONTRIBUTING.md/ README.md/CODEOWNERS content from whatever repo /create-dev-loop is run against, so a hostile target repo could attempt to manipulate the generation process. Only run it against trusted repos.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to the open-source prep audit (#59, #60, #63, #64, #65, #66).
create-dev-loop.mdreadsCLAUDE.md/CONTRIBUTING.md/README.md/CODEOWNERS/recent PRs from whatever repo you run/create-dev-loopin, and that content shapes what the generated skill does — its stated identity, rubric, reviewer, branch conventions — before it goes on togh/gitautonomously. Documents that this is a trust-the-target-repo model, same class of risk as running any agent against untrusted input, and that the policy covers the generation process itself, not downstream generated skills' behavior.README.md.Test plan
python3 scripts/check_docs.pypasses (new README link resolves, no placeholder/step drift)drafted by Claude on behalf of Daniel Stephenson