本项目与安全强相关：它编排隔离的 Subagent 来盲测和修改 Agent Skill， 并在宿主无法强制角色边界时返回 SAFETY_BLOCKED。

This project is security-relevant: it orchestrates isolated subagents to blind-test and patch Agent Skills, and returns SAFETY_BLOCKED when a host cannot enforce role boundaries.

The skill package specifies and validates the optimization protocol. It does not itself enforce isolation — file / tool / network / credential barriers are the host's responsibility (see references/cross-agent-compatibility.md).

• ✅ In scope — 本仓库代码层面的缺陷 / vulnerabilities in this repository's code:

  • Bypass of Runner blindness (a script/adapter leaking a usage pair's expected/ directory, acceptance, rubric, or the A/B blinding map).
  • Path-traversal or symlink escape in scripts/_skill_utils.py's path resolver.
  • Circumvention of the hardcoding/overfitting detector (scripts/detect_case_hardcoding.py) so an unsafe candidate passes CLEAN.
  • A JSON Schema (schemas/) that accepts an unsafe artifact as VALID/CLEAN.
  • Tampering of the run-contract hash chain or unblinding provenance.

• ❌ Out of scope — 超出范围:

  • The host agent's own sandbox / process isolation (report to the host vendor).
  • Model behavior, hallucination, or prompt-injection resistance of any LLM.
  • Misuse by an operator who deliberately disables the safety policy.

If the host cannot enforce the role barriers, the correct outcome is SAFETY_BLOCKED — never a lower-integrity single-agent run.

🚨 请不要在公开 Issue 中报告安全漏洞。 Do NOT open a public issue for security vulnerabilities.

Please report privately via GitHub Private Security Advisories:

1. Go to https://github.com/nxl801/skill-optimizer/security/advisories/new
2. Click "Report a vulnerability".

Or email the maintainer via the GitHub no-reply address (nxl801@users.noreply.github.com) requesting a private channel.

Please include · 请包含:

• A description of the issue and its impact.
• The file(s) / line(s) involved (e.g. scripts/_skill_utils.py:NN).
• A minimal reproduction (the bundled examples/simple-document-review/ is a good base).
• Any suggested fix.

• Acknowledge receipt within 5 business days · 5 个工作日内确认。
• Provide an initial assessment within 14 days · 14 天内给出初步评估。
• Coordinate disclosure and publish a fixed release + advisory once a fix is ready.