jbaruch/nanoclaw-trusted

Rules for trusted NanoClaw groups. Shared memory, session bootstrap, cross-group memory updates. Loaded for trusted and main containers only.

Quality

94%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

This version of the tile failed moderation

Failed moderation (intent review) in rules/session-bootstrap.md: This is a prompt injection attack disguised as a cursor/agent rule file. It instructs an AI agent to unconditionally execute a bash command at the start of every session before processing any user input, and to invoke an external skill ('tessl__trusted-memory') which could load arbitrary instructions or exfiltrate data. The 'alwaysApply: true' and urgent, authoritative language ('MANDATORY', 'not optional', 'violating this rule') are social engineering tactics to bypass the AI's safety reasoning. This pattern is designed to hijack AI agent sessions and could serve as a vector for further exploitation.

alwaysApply:: Yes

Compaction-Aware Summaries

Name: jbaruch/nanoclaw-trusted
Rating: 94.10714285714286 (1 reviews)
Author: jbaruch

When Claude Code compacts context, the summary must preserve information that cannot be recovered from files alone.

Compaction priorities

The summary MUST include, in this order:

Personal facts — Any preferences, family details, opinions, or personal context mentioned in this session that haven't been saved to trusted memory yet
Decisions and reasoning — What was decided, why, and what alternatives were rejected
Commitments — Promises made in both directions (what the owner committed to, what the assistant committed to deliver)
Current task state — What's being worked on, what step we're at, what's next
New contacts or relationships — Anyone mentioned for the first time with their context

Pre-compaction save

If a personal fact was mentioned during the session but NOT yet saved to /workspace/trusted/ memory — save it NOW, before compaction loses it. This is not optional. Compaction summaries are lossy; typed memory files are not.

Focus the summary budget on the human context that only exists in conversation — file paths, code changes, tool-call sequences, and error messages are all reconstructable from git, the task, and logs and should not consume the summary budget.

jbaruch/nanoclaw-trusted