From e9bb3b8883de447011e908caa02a1f47f4ecaa26 Mon Sep 17 00:00:00 2001 From: UnbreakableMJ Date: Tue, 15 Sep 2026 20:06:28 +0300 Subject: [PATCH] =?UTF-8?q?chore:=20add=20NOTICE.md=20and=20SECURITY.md=20?= =?UTF-8?q?(=C2=A75.2,=20=C2=A726.1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both were absent. SECURITY.md is written for what this repository actually distributes: skills are instructions a model loads and acts on, so a skill that tells an agent to run a destructive command, disable a safety gate, or trust an untrusted input is a vulnerability here — not a documentation bug — and it reaches every session that loads it. Injection through skill content is named for the same reason: reference files and quoted upstream material are read by a model as context, and smuggled directives land in a privileged place. construct-cli is in scope separately; it writes to ~/.claude/skills/ and unpacks archives. The file asks for the passage and what an agent would do having read it, and says explicitly that no proof-of-concept is wanted. It also notes that installed bundles are stale until reinstalled, so an advisory must name the skill and version rather than assume a fix propagates. NOTICE.md derives from /spacecraft-software/license/, whose templates ship without SPDX tags and fail `reuse lint` on copy — the header is added here and the template should be fixed at source. reuse lint: 647/647 files. Co-Authored-By: Claude Opus 5 --- NOTICE.md | 63 +++++++++++++++++++++++++++++++++++++++++++++++++++++ SECURITY.md | 57 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 120 insertions(+) create mode 100644 NOTICE.md create mode 100644 SECURITY.md diff --git a/NOTICE.md b/NOTICE.md new file mode 100644 index 0000000..f817592 --- /dev/null +++ b/NOTICE.md @@ -0,0 +1,63 @@ + + +# NOTICE + +## Project Posture + +Spacecraft Software is a **personal hobby project** maintained by Mohamed Hammad. Its +primary purpose is to serve the maintainer's own use case — a Rust-first +systems software stack, tooling, and rewrites that the maintainer wants to +run on his own machines. Most subprojects are developed at hobby pace and +shaped around that workflow. + +A handful of subprojects (e.g., **Anvil-SSH**) are intentionally designed and +maintained with general use in mind. Where this applies, it is stated +explicitly in that subproject's `README.md`. The umbrella as a whole is not. + +## No Warranty + +Spacecraft Software and every subproject under it are provided **AS IS**, without +warranty of any kind, express or implied. This includes — but is not limited +to — implied warranties of merchantability, fitness for a particular purpose, +non-infringement, and the absence of latent defects. The entire risk as to +quality and performance lies with the user. + +## No Liability + +In no event shall the maintainer be liable for any claim, damages, or other +liability — whether in an action of contract, tort, or otherwise — arising +from, out of, or in connection with this software, its use, or its inability +to be used. This includes, without limitation, data loss, hardware damage, +business interruption, security incidents, and any direct, indirect, +incidental, special, exemplary, or consequential damages of any kind. + +## Authoritative Terms + +The statements above describe the maintainer's posture in plain language. The +formal, legally binding terms are those of the **GNU General Public License, +version 3 or later** (`GPL-3.0-or-later`). In any conflict between this +notice and the license text, the license text governs. + +The full license is available at +and in the project's `LICENSE` file. + +## Contributions, Suggestions, and Forks + +- Contributions and suggestions are welcome — see [`CONTRIBUTING.md`](./CONTRIBUTING.md). +- PR acceptance is at the maintainer's sole discretion. +- Forking under GPL-3.0-or-later is always available and encouraged when + goals diverge. + +## Maintainer + +Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org> +Copyright (c) 2026 Mohamed Hammad +License: GPL-3.0-or-later +Website: + +--- + +*--- Forged in Spacecraft Software ---* diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..71bae35 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,57 @@ + + +# Security Policy + +Standard §26.1 requires every Spacecraft Software repository to state where a +vulnerability report goes and what happens to it. + +## Scope + +This repository holds **agent skills** — instructions a language model loads and +acts on — plus `construct-cli`, the Rust tool that packages and installs them. +That shapes what a vulnerability looks like here, and two classes matter more +than they would elsewhere: + +- **A skill that instructs an agent to do something unsafe.** A skill is + executed by a model with tool access. Text that tells it to run a destructive + command, disable a safety gate, exfiltrate a file, or trust an untrusted input + is a vulnerability in this repository, not a documentation bug — and it + reaches every session that loads the skill. +- **Injection through skill content.** Skills carry reference files, code + samples, and quoted upstream material. Content that smuggles instructions into + a context where a model will read them as directives is in scope. + +Also in scope: `construct-cli` itself (it writes to `~/.claude/skills/` and +unpacks archives), the CI gates, and any credential or private path committed by +mistake. + +Out of scope: a vulnerability in a *project governed by* a skill here belongs to +that project's own repository. + +## Reporting + +Email `Mohamed.Hammad [at] SpacecraftSoftware.org`. Do not open a public issue +for anything that should not be public. + +For a skill-content report, quote the passage and say what an agent would do +having read it. That is the whole of the report — no proof-of-concept is needed, +and we would rather not have one. + +## What to expect + +| | | +|---|---| +| Acknowledgement | within 7 days | +| Assessment | within 30 days | +| Supported versions | `main`, and the most recently published bundle of the affected skill | +| Disclosure | coordinated; the fix lands before any public description | +| Credit | offered by default, declined on request | + +A fix to skill content ships as a new bundle; installed copies are stale until +reinstalled, so an advisory will say which skill and which version. + +This is a personal hobby project (§5.1). There is no SLA, and the targets above +are intentions rather than commitments.