chore: add NOTICE.md and SECURITY.md (§5.2, §26.1) - #74
Conversation
Both were absent. SECURITY.md is written for what this repository actually distributes: skills are instructions a model loads and acts on, so a skill that tells an agent to run a destructive command, disable a safety gate, or trust an untrusted input is a vulnerability here — not a documentation bug — and it reaches every session that loads it. Injection through skill content is named for the same reason: reference files and quoted upstream material are read by a model as context, and smuggled directives land in a privileged place. construct-cli is in scope separately; it writes to ~/.claude/skills/ and unpacks archives. The file asks for the passage and what an agent would do having read it, and says explicitly that no proof-of-concept is wanted. It also notes that installed bundles are stale until reinstalled, so an advisory must name the skill and version rather than assume a fix propagates. NOTICE.md derives from /spacecraft-software/license/, whose templates ship without SPDX tags and fail `reuse lint` on copy — the header is added here and the template should be fixed at source. reuse lint: 647/647 files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e9bb3b8883
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1,63 @@ | |||
| <!-- | |||
| SPDX-FileCopyrightText: 2026 Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org> | |||
| SPDX-License-Identifier: CC-BY-SA-4.0 | |||
There was a problem hiding this comment.
Both new files declare CC-BY-SA-4.0, but the repository's catch-all REUSE.toml annotation uses precedence = "override" and assigns GPL-3.0-or-later, suppressing these inline declarations; moreover, LICENSES/CC-BY-SA-4.0.txt is absent. Consequently, REUSE consumers treat the files as GPL even though their headers say CC, and NOTICE.md also states GPL in its footer. Add a path-specific CC override and the corresponding license text, or consistently declare the files GPL.
AGENTS.md reference: AGENTS.md:L567-L569
Useful? React with 👍 / 👎.
| Spacecraft Software is a **personal hobby project** maintained by Mohamed Hammad. Its | ||
| primary purpose is to serve the maintainer's own use case — a Rust-first | ||
| systems software stack, tooling, and rewrites that the maintainer wants to | ||
| run on his own machines. Most subprojects are developed at hobby pace and | ||
| shaped around that workflow. |
There was a problem hiding this comment.
This repository-level notice describes the entire Spacecraft Software umbrella and discusses unrelated subprojects such as Anvil-SSH, without ever stating Construct's own posture. The governing Standard's §5.2 requires each repository's posture files to customize the project name and scope, so this notice currently purports to set expectations and liability posture for other repositories instead of documenting the project in which it ships.
AGENTS.md reference: AGENTS.md:L47-L51
Useful? React with 👍 / 👎.
| | Acknowledgement | within 7 days | | ||
| | Assessment | within 30 days | | ||
| | Supported versions | `main`, and the most recently published bundle of the affected skill | | ||
| | Disclosure | coordinated; the fix lands before any public description | |
There was a problem hiding this comment.
The disclosure policy only says that publication follows a fix, so if a fix is delayed or declined, a reporter is left under an indefinite embargo with no stated release point. The governing §26.1 in spacecraft-steelbore-standard/references/engineering-process.md requires both the embargo the maintainer will honor and the point at which a finding may be published regardless of fix status; add a concrete deadline or decision condition.
AGENTS.md reference: AGENTS.md:L47-L51
Useful? React with 👍 / 👎.
| |---|---| | ||
| | Acknowledgement | within 7 days | | ||
| | Assessment | within 30 days | | ||
| | Supported versions | `main`, and the most recently published bundle of the affected skill | |
There was a problem hiding this comment.
The policy scopes support to the latest published bundle and later promises to identify an affected version, but 41 of the 45 skills in this commit have no version field, the bundle filenames are unversioned, and installed zip contents retain no source commit identity. A user with a stale installed copy therefore cannot determine whether it is the supported or affected bundle; define a revision/hash identifier that advisories and consumers can inspect, or add version metadata to every bundle.
AGENTS.md reference: AGENTS.md:L47-L51
Useful? React with 👍 / 👎.
1 participant
Both were absent from a repository that ships 45 skills.
SECURITY.mdis scoped to what this repo actually distributesSkills are instructions a language model loads and acts on. That makes two classes of defect a security problem here rather than a documentation one:
construct-cliis in scope separately — it writes to~/.claude/skills/and unpacks archives.The reporting section asks for the passage and what an agent would do having read it, and says explicitly that no proof-of-concept is wanted. It also notes that installed bundles are stale until reinstalled, so an advisory has to name the skill and version rather than assume a fix propagates.
One thing to fix at source
/spacecraft-software/license/'s templates ship without SPDX tags and failreuse lintthe moment they're copied. The header is added here, but every repo deriving from those templates inherits the problem. Same finding as Standard#42.Verification
reuse lint— 647/647 files. All ten §5.2 + §6.5 + §5.7 artifacts now present.🤖 Generated with Claude Code