Repository navigation
chore(security): add OSS Scanner build and threat model - #750
Merged
Merged
Conversation
Prepare enrollment in Anthropic's opt-in OSS vulnerability scanner: - .oss-scanner/Dockerfile builds asm and runs the unit suite so the offline scan has every dependency in the image - .oss-scanner/threat_model.md states where untrusted input enters, the security goals, scope, and the severity rubric - SECURITY.md lists an email security contact for scanner reports Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #749
Prepares asm for enrollment in Anthropic's opt-in vulnerability-finding service for open source (announcement, FAQ). The enrollment PR on
anthropics/oss-scannerpoints at these paths, so this needs to land onmainfirst.Changes
.oss-scanner/Dockerfile:node:22-bookworm+ git/python3,npm ci,npm run build,npm link, thennpm test(non-fatal). The scan runs offline, so everything is fetched at build time..oss-scanner/threat_model.md: untrusted inputs (skill sources, registry, manifests and bundles, frontmatter), security goals (install/import must not execute skill code; no writes or reads outside skill dirs; no argv injection), in-scope and out-of-scope paths, and a severity rubric.SECURITY.md: addsluongnv89@gmail.comas an email security contact next to GitHub private advisories.Verification
npm ci && npm run build): build OK. Docker isn't usable on the dev box, sotools/checkwas not run.tools/validate.pyin oss-scanner passes withprojects/agent-skill-manager/project.yamlpointing at these paths.🤖 Generated with Claude Code