docs: expand security posture references for contributor and maintainer workflows

This commit is contained in:
sck_0
2026-03-15 10:02:22 +01:00
parent ee53e7d8e7
commit 74e4cccd70
8 changed files with 76 additions and 9 deletions

View File

@@ -231,7 +231,7 @@ Rules:
## 3. 🛡️ Governance & Quality Bar
### A. The 5-Point Quality Check
### A. The 6-Point Quality Check
Reject any PR that fails this:
@@ -239,7 +239,8 @@ Reject any PR that fails this:
2. **Safety**: `risk: offensive` used for red-team tools?
3. **Clarity**: Does it say _when_ to use it?
4. **Examples**: Copy-pasteable code blocks?
5. **Limitations / Safety Notes**: Edge cases and risk boundaries are stated clearly.
5. **Risk Limits**: If the skill includes shell/network/filesystem/mutation guidance, instructions include explicit prerequisites and warnings.
6. **Repo Security Scan**: Run `npm run security:docs` for command-heavy, network-execution, or token-like guidance in `SKILL.md`.
### B. Risk Labels (V4)