open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

docs(llm-security): replace 5 placeholder URLs with real self-demo URL or explicit <owner>/<repo>

Browse source 
Census (AAA+ round 5) measured 4 FAIL + 1 unmeasured across L55, L206, L207,
L402, L403: strings that look like clickable URLs but are template leftovers
(https://repo-url resolves nowhere; https://github.com/org/repo 404s). L55 is
in an [!IMPORTANT] callout selling the plugin's primary CLAUDE.md-poisoning
defense, so its one example command couldn't be run as written.

First example in each command block now uses a real, resolving self-demo URL
(https://git.fromaitochitta.com/open/llm-security), making the README a
working quickstart instead of an illustration. Remaining variants use an
unambiguous <owner>/<repo> placeholder that doesn't read as a real URL.

L14 (SSRN, 403) and L224 (sandbox-exec docs, 503) are untouched — bot-blocked
or transiently unavailable is not evidence of a dead link.

Order: 20260818T114340Z-186999443-from-.claude

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JCinQGjXauCrGBqKoFNs4u
This commit is contained in:
Kjell Tore Guttormsen 2026-08-18 14:30:32 +02:00
commit 9ce8821ab4
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
README.md
View file

@ -52,7 +52,7 @@ This is not theoretical. ToxicSkills (Xi'an Jiaotong, 2025), ClawHavoc (Repello
This plugin layers three independent kinds of defense — **runtime hooks** that block, **deterministic scanners** that compute, and **LLM-driven advisory commands** that judge — so failures in any one layer are caught by the others.
> [!IMPORTANT]
> **Scan repos remotely before cloning.** A poisoned `CLAUDE.md` injects instructions into the model context the moment you open a cloned repo — before any hook can intervene. `/security scan https://repo-url --deep` analyses everything safely via pre-extraction, without loading anything into your session. This is the primary defense against `CLAUDE.md` poisoning.
> **Scan repos remotely before cloning.** A poisoned `CLAUDE.md` injects instructions into the model context the moment you open a cloned repo — before any hook can intervene. `/security scan https://git.fromaitochitta.com/open/llm-security --deep` analyses everything safely via pre-extraction, without loading anything into your session. This is the primary defense against `CLAUDE.md` poisoning.
---
@ -203,8 +203,8 @@ Each layer is independent. A failure in one (e.g. an injection that slips past t
`/security scan` and `/security plugin-audit` accept GitHub and Forgejo URLs directly. The plugin clones to a temp directory inside an OS sandbox, scans, and cleans up.
```
/security scan https://github.com/org/repo --deep
/security scan https://github.com/org/repo --branch dev --deep
/security scan https://git.fromaitochitta.com/open/llm-security --deep
/security scan https://github.com/<owner>/<repo> --branch dev --deep
```
**Defense-in-depth on the clone path** (v5.1+):
@ -399,8 +399,8 @@ Average ~69 %. Strongest at prompt injection (95 % with input + output scanning
/security plugin-audit path/to/plugin # Install/Review/Do Not Install
# Remote — scans without installing
/security scan https://github.com/org/repo --deep
/security plugin-audit https://github.com/org/repo
/security scan https://git.fromaitochitta.com/open/llm-security --deep
/security plugin-audit https://github.com/<owner>/<repo>
```
### 2 — monthly review