Kjell Tore Guttormsen
c05c00d70f
Layer 4 is accepted as-is: opt-in, off by default, and disclosed in the README. Both bundled concerns (inferred-state gating, and a named commercial endorsement in a public plugin) are acknowledged as known, disclosed risk. No behavioural change, so no version bump. Also records three facts established while making the call: - Layer 4 is enforced by prompt text only; requireLayer(4) is never called, so "opt-in, off by default" is an instruction, not a code guarantee. - SKILL.md is not part of the F-1 surface (scope correction). - tests/ has no Layer 4 coverage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUgkGDgwzT8Ni4SxQtsfvR
65 lines
4.9 KiB
Markdown
65 lines
4.9 KiB
Markdown
# Plugin review — ai-psychosis (2026-06-20)
|
|
|
|
> Full-depth review (part of the marketplace-wide sweep; pilot was okr). Tooling: config-audit
|
|
> v5.4.0 scanners (from source) + llm-security posture assessor + structure/version checks.
|
|
> Read-only; this file is the only artifact.
|
|
|
|
## Verdict
|
|
|
|
**Grade B — trustworthy mechanics, editorially self-interested.** No code-execution, no network
|
|
egress, no credential access; the central privacy claim ("prompt text never written to disk") is
|
|
real and test-enforced (canary + matched-phrase assertions across the hook lifecycle). The concerns
|
|
are **content governance**, not technical exfiltration.
|
|
|
|
## Results by dimension
|
|
|
|
| Dimension | Result |
|
|
|-----------|--------|
|
|
| config-audit posture | **A** (Feature Coverage F 36 — expected) |
|
|
| config-audit plugin-health | 2 findings: "CLAUDE.md missing commands/hooks section" — **legitimate** (ships 1 command + a hook). |
|
|
| llm-security posture | **B** — see findings. Zero npm deps; no `child_process`/`eval`/network anywhere; prompt variable explicitly cleared (`prompt-analyzer.mjs:290`). |
|
|
| structure / hygiene | README ✓, CHANGELOG ✓, CLAUDE.md ✓, LICENSE ✓ |
|
|
| version consistency | **OK** (gate) |
|
|
|
|
## Findings
|
|
|
|
| ID | Severity | Location | Finding |
|
|
|----|----------|----------|---------|
|
|
| F-1 | **Medium** | `commands/interaction-report.md:382-391` | Layer-4 instructs Claude to append a verbatim, change-prohibited paragraph promoting an external commercial wellness program (Sadhguru "Miracle of Mind"), auto-triggered when `total flags >= 5 OR fatigue >= 2` — i.e. gated on the user's inferred emotional state, in a plugin marketed as "observation, not intervention." Opt-in (`layer4:false` default) and README-disclosed, which lowers severity. **This is the item to make an explicit accept/reject call on.** Recommend: gate/remove the promotion, or at least strip the emotional-state trigger + the "do not modify" lock. |
|
|
| F-3 | Low (misinformation) | `README.md:544-552`, `SKILL.md:51-108` | Research citations presented as load-bearing authority that cannot be verified (future-dated arXiv IDs, an "April 2026 Anthropic guidance" quoted verbatim); the report command itself admits its "5-scale" is paraphrased, not a real Anthropic metric. **Recommend:** verify-or-remove. |
|
|
| F-2 | Low | `skills/ai-psychosis/SKILL.md:3-13` | "MANDATORY OVERRIDE … takes precedence over being helpful" auto-loads every conversation. Content is benign/pro-safety; flagged because the *structural pattern* (a skill claiming blanket precedence) is what a malicious skill would use. Governance note. |
|
|
| F-5 | Low (defense-in-depth) | `lib.mjs:233,59` | `session_id`/`cwd` interpolated into state-file paths without validation. Harness-supplied (not user-controlled) → not currently exploitable. Cheap fix: allowlist `^[A-Za-z0-9_-]+$` before path use. |
|
|
|
|
`/interaction-report` reading JSONL into context (F-4) is currently safe — records hold only a
|
|
tool-name enum + domain labels, no free text. Noted only as a future sink.
|
|
|
|
## Decisions
|
|
|
|
### F-1 — accepted as-is (operator decision, 2026-08-02)
|
|
|
|
**Accept.** Layer 4 ships unchanged: the `flags >= 5 OR fatigue >= 2` trigger, the verbatim
|
|
paragraph, and the "do not modify" lock all remain as written.
|
|
|
|
Rationale: Layer 4 is opt-in and off by default (`layer4: false`), the reference and its
|
|
commercial nature are disclosed in `README.md:102-119`, and the paragraph is framed as the
|
|
author's personal pointer rather than a claim about the user. The two distinct concerns the
|
|
finding bundles — (A) inferred emotional state gating served content, and (B) a publicly
|
|
distributed plugin carrying a named commercial endorsement — are both acknowledged and accepted
|
|
as known, disclosed risk. No behavioural change, so no version bump; the plugin stays at v1.2.1.
|
|
|
|
Established while making the call, and not previously recorded in this review:
|
|
|
|
- **Layer 4 is enforced by prompt text only.** `requireLayer(4)` is never called. `lib.mjs:85-96`
|
|
handles `n === 3` and `n === 4`, but the only call sites in the repo are `requireLayer(2)` in
|
|
the four hook scripts. The `layer4: true` config gate, the flag trigger, and the "do not modify"
|
|
instruction are all directives inside `commands/interaction-report.md` that Claude self-enforces
|
|
at report time. This follows from Layers 3/4 being slash-command-driven rather than hook-driven,
|
|
and it does not change the accept — but "opt-in, off by default" is an instruction, not a code
|
|
guarantee.
|
|
- **Scope correction:** `skills/ai-psychosis/SKILL.md` is *not* part of the F-1 surface (zero
|
|
matches for `sadhguru|miracle of mind|layer4`). The surface is `commands/interaction-report.md:372-394`,
|
|
`README.md:102-119`, and `lib.mjs:52,81,89`.
|
|
- **No test coverage:** `tests/` contains no Layer 4 assertions — neither the paragraph nor its
|
|
gate is verified by the suite.
|
|
|
|
Still open from this review: F-3 (verify-or-remove the research citations), F-2, F-5.
|