feat: add Tier 1 supply chain hardening

- Org allowlist: TRUSTED_OWNERS in skill_security.py, verify script rejects unknown owners
- Compare URLs: clickable GitHub diff links in refresh report
- Content scanning: 10 prompt injection patterns checked against fetched SKILL.md files
- Scan gate: manifest update blocked if warnings found (--force to override)
- GitHub settings recommendations documented in CLAUDE.md
- Security Exploitability Gate added to Design Rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: AlexU-A

CLAUDE.md

@@ -29,6 +29,7 @@ python3 scripts/aggregate_stability.py
 - No-copy policy: external skills are referenced in manifests with pinned commits.
 - Max 3 external skills loaded per run.
 - Evidence required for CRITICAL/MAJOR findings.
+- Security Exploitability Gate: security findings must demonstrate a concrete exploit path reachable by non-privileged users. Unconfirmed findings tagged `[UNCONFIRMED]` and moved to Open Questions.
 - Shared JS-core rubric + critic-specific rubrics.
 
 ## Supply Chain Security
@@ -40,6 +41,16 @@ External skills are loaded by reference (pinned commit SHA + content SHA-256 has
 - `verify_no_copied_skills.py --verify-content` fetches and re-hashes to detect tampering.
 - CI validates manifest structure; full content verification available via `--verify-content`.
 
+### GitHub Repository Settings (manual setup)
+
+Upstream skill repos should be configured with:
+- **Signed commits**: require commit signature verification on default branch.
+- **Branch protection**: require PR reviews and status checks before merge to default branch.
+- **No force push**: disable force push to default branch to preserve commit history integrity.
+
+These are manual configurations on each upstream repo — they cannot be enforced from this repo,
+but should be verified before adding a new owner to `TRUSTED_OWNERS`.
+
 ## Benchmark Infrastructure
 
 - Fixtures: `research/benchmarks/fixtures/{react,next,react-native}/` (8 per critic)

scripts/refresh_external_skills.py

@@ -3,13 +3,17 @@
 import difflib
 import hashlib
 import subprocess
+import sys
 import urllib.request
 import urllib.error
 from datetime import datetime, timezone
 from pathlib import Path
 
 import yaml
 
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from skill_security import scan_content
+
 ROOT = Path(__file__).resolve().parent.parent
 MANIFESTS = sorted(ROOT.glob('.claude/skills/*/references/external-skills-manifest.yaml'))
 REPORT = ROOT / 'research/javascript-skills/reports/external-skills-refresh-report.md'
@@ -51,14 +55,25 @@ def show_diff(skill_id: str, old_content: str | None, new_content: str | None) -
         print(f'  (no content diff for {skill_id})')
 
 
+def make_compare_url(repo_url: str, old_sha: str, new_sha: str) -> str:
+    owner_repo = repo_url.removeprefix('https://github.com/')
+    if old_sha:
+        return f'https://github.com/{owner_repo}/compare/{old_sha}...{new_sha}'
+    return f'https://github.com/{owner_repo}/commit/{new_sha}'
+
+
 def main() -> int:
     parser = argparse.ArgumentParser(description='Refresh pinned commits in all critic manifests.')
     parser.add_argument('--check', action='store_true', help='Fail if updates are needed without writing files.')
     parser.add_argument('--approve', action='store_true', help='Apply pin and content hash updates (writes manifests).')
+    parser.add_argument('--force', action='store_true', help='Allow --approve to proceed despite content scan warnings.')
     args = parser.parse_args()
 
+    # Each entry: (manifest, skill_id, old_sha, new_sha, new_hash_or_None, repo_url)
     changes = []
     checked = 0
+    all_scan_warnings: list[str] = []
+    pending_writes: list[tuple[Path, dict]] = []
 
     for manifest in MANIFESTS:
         data = yaml.safe_load(manifest.read_text(encoding='utf-8')) or {}
@@ -84,12 +99,18 @@ def main() -> int:
             if new_content is not None:
                 new_hash = sha256_of(new_content)
                 print(f'  content_sha256 (new): {new_hash}')
+                scan_warnings = scan_content(new_content, s['id'])
+                if scan_warnings:
+                    print(f'  SCAN WARNINGS ({len(scan_warnings)}):')
+                    for w in scan_warnings:
+                        print(w)
+                    all_scan_warnings.extend(scan_warnings)
             else:
                 new_hash = None
                 print(f'  WARNING: Could not fetch new content — content_sha256 will be unverified.')
 
             local_changes.append((s['id'], current, latest, new_hash))
-            changes.append((manifest, s['id'], current, latest, new_hash))
+            changes.append((manifest, s['id'], current, latest, new_hash, s.get('repo_url', '')))
 
             if args.approve:
                 s['pinned_commit'] = latest
@@ -98,7 +119,17 @@ def main() -> int:
                 else:
                     s.pop('content_sha256', None)
 
-        if local_changes and args.approve:
+        if local_changes:
+            pending_writes.append((manifest, data))
+
+    # Scan gate: block all writes if warnings found without --force
+    if all_scan_warnings and not args.force:
+        print(f'\nContent scan found {len(all_scan_warnings)} warning(s). Review and use --approve --force to override.')
+        if args.approve:
+            return 2
+
+    if args.approve and (not all_scan_warnings or args.force):
+        for manifest, data in pending_writes:
             data['generated_at'] = datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z')
             manifest.write_text(yaml.safe_dump(data, sort_keys=False), encoding='utf-8')
 
@@ -112,11 +143,12 @@ def main() -> int:
     ]
 
     if changes:
-        lines.append('| Manifest | Skill | Old | New | Hash Verified |')
-        lines.append('|---|---|---|---|---|')
-        for m, sid, old, new, new_hash in changes:
+        lines.append('| Manifest | Skill | Old | New | Hash Verified | Compare |')
+        lines.append('|---|---|---|---|---|---|')
+        for m, sid, old, new, new_hash, repo_url in changes:
             verified = 'yes' if new_hash else '# UNVERIFIED'
-            lines.append(f'| `{m.relative_to(ROOT)}` | `{sid}` | `{old or "-"}` | `{new}` | {verified} |')
+            compare_url = make_compare_url(repo_url, old, new)
+            lines.append(f'| `{m.relative_to(ROOT)}` | `{sid}` | `{old or "-"}` | `{new}` | {verified} | [compare]({compare_url}) |')
     else:
         lines.append('No pin changes detected.')
 

scripts/skill_security.py

@@ -0,0 +1,43 @@
+"""Shared supply-chain security utilities for skill manifest tooling."""
+import re
+
+TRUSTED_OWNERS = frozenset({
+    'auth0',
+    'callstack',
+    'callstackincubator',
+    'clerk',
+    'dotneet',
+    'expo',
+    'getsentry',
+    'github',
+    'millionco',
+    'mindrally',
+    'react-native-community',
+    'sickn33',
+    'vercel-labs',
+    'wshobson',
+    'wsimmonds',
+})
+
+INJECTION_PATTERNS = [
+    (re.compile(r'ignore\s+(?:all\s+|any\s+|previous\s+|prior\s+|above\s+)?(?:instructions|rules|guidelines)', re.IGNORECASE), 'instruction override'),
+    (re.compile(r'you\s+are\s+now\b', re.IGNORECASE), 'identity override'),
+    (re.compile(r'from\s+now\s+on\b.*?\b(?:ignore|forget|disregard)', re.IGNORECASE), 'behavioral override'),
+    (re.compile(r'system\s+(?:prompt|message|instruction)', re.IGNORECASE), 'system prompt reference'),
+    (re.compile(r'disregard\s+(?:all\s+|any\s+|previous\s+|prior\s+)?(?:instructions|rules|guidelines|constraints)', re.IGNORECASE), 'instruction disregard'),
+    (re.compile(r'<script[\s>]', re.IGNORECASE), 'script injection'),
+    (re.compile(r'javascript\s*:', re.IGNORECASE), 'javascript URI'),
+    (re.compile(r'data:\s*\w+/\w+;base64,', re.IGNORECASE), 'base64 data embed'),
+    (re.compile(r'<\s*(?:invoke|tool_use|function_call)', re.IGNORECASE), 'tool invocation injection'),
+    (re.compile(r'\bIMPORTANT\s*:\s*(?:ignore|override|disregard|forget)', re.IGNORECASE), 'priority override'),
+]
+
+
+def scan_content(content: str, skill_id: str) -> list[str]:
+    """Scan skill content for prompt injection patterns. Returns list of warning strings."""
+    warnings = []
+    for pattern, description in INJECTION_PATTERNS:
+        for match in pattern.finditer(content):
+            line_num = content[:match.start()].count('\n') + 1
+            warnings.append(f'  {skill_id} line {line_num}: {description} — matched "{match.group()}"')
+    return warnings

scripts/verify_no_copied_skills.py

@@ -10,6 +10,9 @@
 
 import yaml
 
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from skill_security import TRUSTED_OWNERS, scan_content
+
 ROOT = Path(__file__).resolve().parent.parent
 MANIFESTS = sorted(ROOT.glob('.claude/skills/*/references/external-skills-manifest.yaml'))
 
@@ -86,6 +89,9 @@ def main() -> int:
                 fail(f'Invalid skills_url for {sid}')
             if not str(s.get('repo_url', '')).startswith('https://github.com/'):
                 fail(f'Invalid repo_url for {sid}')
+            owner = sid.split('/')[0]
+            if owner not in TRUSTED_OWNERS:
+                fail(f'Untrusted owner "{owner}" for {sid}. Add to TRUSTED_OWNERS in scripts/skill_security.py if approved.')
             if not SHA_RE.match(str(s.get('pinned_commit', ''))):
                 fail(f'Invalid pinned_commit for {sid}')
             if s.get('status') not in {'active', 'deprecated'}:
@@ -117,6 +123,14 @@ def main() -> int:
                     else:
                         print(f'  OK: {sid} content hash verified.')
 
+                if content is not None:
+                    scan_warnings = scan_content(content, sid)
+                    if scan_warnings:
+                        print(f'  SCAN WARNINGS ({len(scan_warnings)}) for {sid}:')
+                        for w in scan_warnings:
+                            print(w)
+                        content_errors += len(scan_warnings)
+
     git_ls = subprocess.check_output(['git', '-C', str(ROOT), 'ls-files'], text=True).splitlines()
     forbidden_prefixes = [
         'research/javascript-skills/upstream/',