agentleFS
Sign inStart free
IgorGanapolskyIgorGanapolsky/ThumbGate/.agents/skills/vulnerability-pre-action-diode/SKILL.md

vulnerability-pre-action-diode

Skill29 starsChanged 7 months agoMITView on GitHub

WHOOP / The New Stack vulnerability triage elimination pattern is FORMAT, not a ThumbGate clone. Intercepts untrusted installs, pipe-to-bash, and unpinned supply-chain artifacts in PreToolUse (<5ms) instead of 3-day post-mortem triage. Calculates quantifiable enterprise ROI. Slash: /vulnerability-pre-action-diode.

  • Pipes a download into a shell
  • Installs packages

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈0

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    test suite passes: npm run test:vulnerability-diode

    line 47

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Vulnerability Pre-Action Diode — compare, do not clone

Goal

Provide deterministic pre-action interdiction on agent dependency installations and shell commands before execution occurs, eliminating the 96-hour post-facto manual triage cycle reported in enterprise environments (WHOOP/TNS).

Constraints

NEVERALWAYS
Clone Datadog Bits AI or workflow orchestratorsEnforce deterministic PreToolUse diodes in <5ms
Allow pipe-to-bash (curl | bash)Block remote script pipes immediately
Allow plaintext http:// package registriesEnforce HTTPS encrypted package endpoints
Allow untrusted package lifecycle scriptsBlock --ignore-scripts false overrides
Claim fake MTTR savingsCite the empirical 96-hour WHOOP/TNS benchmark

CLI Procedures

# Evaluate a tool call
node scripts/vulnerability-pre-action-diode.js --check="npm install express" --json

# Run enterprise ROI calculation
node scripts/triage-savings-calculator.js --vulnerabilities=4 --interdictions=24 --tier=enterprise --json

# Run unit tests
npm run test:vulnerability-diode

Rubric

  • critical violations (pipe_to_bash, insecure_protocol_dependency, known_compromised_package) return verdict: 'block'
  • unpinned installs return verdict: 'review'
  • pinned installs return verdict: 'allow'
  • triage hours saved computed accurately ($125/hr blended rate)
  • test suite passes: npm run test:vulnerability-diode

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free