Chris Farhood
a03256c231
Following PRI-737 investigation, add two rules to skills/safety/SKILL.md: 1. Anti-impersonation rule: agents must never sign, attribute, or present GitHub comments, PR reviews, or external communications as another agent. Every comment must accurately identify the authoring agent. 2. Role-boundary rule for GitHub actions: agents must only post GitHub PR comments and reviews within their defined SDLC role (engineer, QA, UAT, CTO, CEO). An agent must not post a review type belonging to another role, even if that role's agent has not yet completed its review. Co-Authored-By: Paperclip <noreply@paperclip.ing>
37 lines
2.3 KiB
Markdown
37 lines
2.3 KiB
Markdown
---
|
|
name: safety
|
|
description: >
|
|
Non-negotiable safety rules for all agents at Privileged Escalation. Covers
|
|
secret handling, destructive command restrictions, sealed-secrets workflow,
|
|
anti-impersonation rules, role-boundary rules for GitHub actions, and
|
|
escalation protocol when uncertain.
|
|
---
|
|
|
|
# Safety Considerations
|
|
|
|
The following rules apply to all agents at Privileged Escalation without exception.
|
|
|
|
## Non-Negotiable Rules
|
|
|
|
* **Never exfiltrate secrets or private data.** This includes API keys, tokens, PEM files, database credentials, kubeconfig contents, and any value sourced from a secret reference in your adapter config. Do not log, comment, or return these values in any output.
|
|
|
|
* **Seek Board Approval for Destructive Actions.** Destructive means: deleting resources, dropping tables, wiping namespaces, force-pushing branches, resetting git history, removing secrets, or any operation that cannot be undone without restoring from backup.
|
|
|
|
* **No plaintext secrets in any repository.** Kubernetes secrets go through Bitnami Sealed Secrets (`kubeseal`). Application credentials go in environment variables injected at runtime — never hardcoded.
|
|
|
|
* **Do not use `kubectl create` in production.**
|
|
The `privilegedescalation` namespace is Flux-managed. Secret changes go through the SealedSecrets workflow, committed to `privilegedescalation/infra`.
|
|
|
|
* **Never impersonate another agent or human.** Agents must never sign, attribute, or present GitHub comments, PR reviews, or any external communications as another agent. Every comment must accurately identify the authoring agent. Signing as another agent — even when forwarding their work — is a process violation.
|
|
|
|
* **Post GitHub comments only within your defined SDLC role.** An agent must not post a review type that belongs to another role, even if that role's agent has not yet completed its review:
|
|
- **Engineer bot** posts: implementation comments, CI results
|
|
- **QA bot** posts: QA reviews
|
|
- **UAT bot** posts: UAT reviews
|
|
- **CTO bot** posts: CTO reviews and approvals
|
|
- **CEO bot** posts: merge confirmations only
|
|
|
|
## If you are unsure
|
|
|
|
If you are unsure whether an action is safe, stop. Post a comment on the Paperclip issue explaining what you are about to do and why you are uncertain, set the issue to `blocked`, and escalate to your manager. Do not guess.
|