chore(publish): SkillSpector-clean ClawHub bundle — baseline + triage + recipe

Ran NVIDIA SkillSpector against the ClawHub export. Raw: 100/CRITICAL/28 findings
— all triaged as false positives (a security scanner keyword/AST-matching a
legitimate, permission-disclosed web-design skill). With a reviewed baseline:
0/SAFE/0 active. Adds:
- .skillspector-baseline.yaml — reviewed false positives (FAL_KEY handling,
  generated-HTML guidance comments, image-gen "prompt" naming, MIT/guardrail text).
- docs/security/skillspector-triage.md — per-category rationale + re-triage steps.
- COMPATIBILITY.md publish recipe: include audit-mode.md + learn-mode.md (complete
  contract), drop maintainer-only tools/skill-sync.mjs, add a SkillSpector verify gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mustbesimo2

.skillspector-baseline.yaml

@@ -0,0 +1,117 @@
+# SkillSpector baseline — findings listed here are suppressed on future scans.
+# Edit 'reason' fields and add glob 'rules' as needed. See docs/SUPPRESSION.md.
+version: 1
+rules: []
+fingerprints:
+- hash: sha256:005fae9fc53a3b0b
+  rule_id: EA3
+  file: LICENSE
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:b487ad71b57c28dd
+  rule_id: EA2
+  file: taste-guardrails.md
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:2dea09b2bf319fb1
+  rule_id: PE3
+  file: manifest.json
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:233a4accc247d12d
+  rule_id: PE3
+  file: tools/check-consistency.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:eeaef921a4949fce
+  rule_id: PE3
+  file: tools/heygen/README.md
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:70f68445955e0c2c
+  rule_id: PE3
+  file: tools/heygen/generate-walkthrough.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:cce6b90479abf5b7
+  rule_id: PE3
+  file: tools/promo/gen-flythrough-assets.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:4de37cdc212221de
+  rule_id: PE3
+  file: tools/promo/gen-flythrough-assets.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:fcb96d6229b496a3
+  rule_id: PE3
+  file: tools/promo/gen-flythrough-assets.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:0e02379477c141b2
+  rule_id: PE3
+  file: tools/promo/gen-flythrough-assets.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:7b314a61e06f676b
+  rule_id: PE3
+  file: tools/promo/gen-theme-heroes.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:fad458216b2d1fd5
+  rule_id: PE3
+  file: tools/promo/gen-theme-heroes.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:f551c430053e74c3
+  rule_id: PE3
+  file: tools/promo/gen-theme-heroes.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:7c59291852ee5a29
+  rule_id: PE3
+  file: tools/promo/gen-theme-heroes.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:9d94246fa8622c0f
+  rule_id: PE3
+  file: tools/promo/gen-theme-heroes.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:685b752dd6989ae2
+  rule_id: P2
+  file: compile-choreography.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:578641c8b12491b3
+  rule_id: P2
+  file: components/mode-a/depth-figure.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:a05147f5a234d13c
+  rule_id: P2
+  file: components/mode-a/hero-parallax.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:4395031da242547c
+  rule_id: P2
+  file: components/mode-a/horizontal-gallery.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:7b7879df973f9dc5
+  rule_id: P2
+  file: components/mode-a/kinetic-headline.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:e04e4367713cd710
+  rule_id: P2
+  file: components/mode-a/magnetic-cursor.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:31413b5c27bbc56e
+  rule_id: P2
+  file: components/mode-a/morph-background.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:19e587073602bbf8
+  rule_id: P2
+  file: components/mode-a/scrub-video.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:adabce263b7b75f9
+  rule_id: P2
+  file: components/mode-a/scrub-video.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:219ef5f0e8e00092
+  rule_id: P2
+  file: components/mode-a/scrub-video.html
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:2bb759a2d7082841
+  rule_id: P2
+  file: references/webxr.md
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:1e21ada85988b62f
+  rule_id: P6
+  file: tools/promo/gen-flythrough-assets.mjs
+  reason: Accepted finding (auto-generated baseline)
+- hash: sha256:a7995659b3857e15
+  rule_id: P6
+  file: tools/promo/gen-theme-heroes.mjs
+  reason: Accepted finding (auto-generated baseline)

COMPATIBILITY.md

@@ -146,12 +146,18 @@ GIF/video/GLB marketing assets (~hundreds of MB):
 ```bash
 # 1. stage a clean export of the skill contract
 EXPORT=$(mktemp -d)
-git archive HEAD SKILL.md design.md manifest.json LICENSE taste-guardrails.md \
-  FRAME.md ASSETS-3D.md MODELS.md tokens/ themes/ components/ evals/ \
+git archive HEAD SKILL.md audit-mode.md learn-mode.md design.md manifest.json LICENSE \
+  taste-guardrails.md FRAME.md ASSETS-3D.md MODELS.md tokens/ themes/ components/ evals/ \
   references/ tools/ examples/PROMPTS.md \
   compile-choreography.mjs scroll-choreography.json | tar -x -C "$EXPORT"
+rm -f "$EXPORT/tools/skill-sync.mjs"   # maintainer-only .codex/.cursor stub sync — not a runtime capability
 
-# 2. authenticate (GitHub account ≥ 1 week old) and publish
+# 2. security scan (NVIDIA SkillSpector) — must come back SAFE before publishing.
+#    The baseline records reviewed false positives; rationale in
+#    docs/security/skillspector-triage.md. Re-triage if NEW findings appear.
+skillspector scan "$EXPORT" --no-llm --baseline .skillspector-baseline.yaml
+
+# 3. authenticate (GitHub account ≥ 1 week old) and publish
 clawhub login
 clawhub skill publish "$EXPORT" --slug cinematic-scroll \
   --name "Cinematic Scroll" --version <X.Y.Z>   # match manifest.json

docs/security/skillspector-triage.md

@@ -0,0 +1,41 @@
+# SkillSpector triage — ClawHub bundle
+
+[NVIDIA SkillSpector](https://github.com/NVIDIA/skillspector) is a security scanner for
+agent skills (prompt injection, data exfiltration, privilege escalation, dangerous code,
+etc.; risk score 0–100). We run it against the **ClawHub export bundle** before publishing.
+
+## Result
+
+- **Raw scan** (`skillspector scan dist/clawhub-export --no-llm`): `score 100 · CRITICAL`,
+  28 findings — **all reviewed as false positives** (see below). SkillSpector's heuristics
+  are tuned to catch *malicious* skills; they keyword/AST-match a legitimate, fully
+  permission-disclosed web-design toolkit.
+- **With the reviewed baseline** (`--baseline .skillspector-baseline.yaml`):
+  `score 0 · LOW · SAFE · 0 active · 28 suppressed`.
+
+One finding was removed **structurally** rather than suppressed: `tools/skill-sync.mjs`
+(a maintainer-only tool that syncs this skill's own `.codex`/`.cursor` pointer stubs) is
+excluded from the bundle — it is not a runtime capability. That dropped the 2 "Agent
+Snooping / Skill Enumeration" flags. `audit-mode.md` + `learn-mode.md` were added so the
+published agent contract is complete; they introduced **no** new findings.
+
+## Why every remaining finding is a false positive
+
+| Category (count) | What SkillSpector matched | Why it is not a vulnerability |
+|---|---|---|
+| **Privilege Escalation / Credential Access (13)** | `.env.local` / `FAL_KEY` strings in `manifest.json`, `tools/check-consistency.mjs`, `tools/heygen/*`, `tools/promo/*` | Correct credential *handling*, not theft. `manifest.json` documents storing the billable `FAL_KEY` in a **gitignored** `.env.local`; `check-consistency.mjs` literally **scans for leaked `.env` files** (a security control); the optional, user-initiated fal.ai/HeyGen scripts read the key from `process.env`. Nothing is harvested or transmitted. All disclosed in `manifest.json → security.thirdPartyNetworkCalls` and the SKILL.md frontmatter `permissions`. |
+| **Prompt Injection / Hidden Instructions (11)** | HTML comments in generated templates, e.g. `<!-- chapter: … LAYOUT IS YOURS: reposition the [data-layer] elements freely … -->` in `compile-choreography.mjs` + `components/mode-a/*.html` | Author-facing guidance comments inside **generated output**, helping a human/agent art-direct the page. They are not instructions smuggled to an agent to take unauthorized action. |
+| **System Prompt Leakage / Direct Prompt Extraction (2)** | the phrase "print prompt" in `tools/promo/gen-flythrough-assets.mjs`, `gen-theme-heroes.mjs` | These print the **fal.ai image-generation prompt** (the text-to-image art prompt), not a system prompt or internal instructions. |
+| **Excessive Agency (2)** | `LICENSE` ("INCLUDING BUT NOT LIMITED TO"); `taste-guardrails.md` ("without consent") | MIT license boilerplate; and a **safety guardrail** (5.6 — "Never force VR locomotion or move the user *without consent*"), i.e. the opposite of a vulnerability. |
+
+## Re-verify / re-triage
+
+```bash
+# build the bundle (see "Publishing a new version" in COMPATIBILITY.md), then:
+skillspector scan "$EXPORT" --no-llm --baseline .skillspector-baseline.yaml   # expect SAFE
+```
+
+The baseline matches specific findings, so a **new** issue in any of these files still
+surfaces. If new findings appear, triage them here and regenerate the baseline
+(`skillspector baseline "$EXPORT" --no-llm -o .skillspector-baseline.yaml`) only after
+each is confirmed benign. Do **not** baseline an unreviewed finding.