jbaruch/nanoclaw-trusted

Rules for trusted NanoClaw groups. Shared memory, session bootstrap, cross-group memory updates. Loaded for trusted and main containers only.

Quality

96%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

This version of the tile failed moderation

Failed moderation (intent review) in rules/session-bootstrap.md: This is a prompt injection attack disguised as a cursor/IDE rule file. It instructs an AI agent to unconditionally execute a bash command and invoke an external skill ('tessl__trusted-memory') at the start of every session before processing any user input. This is a social engineering/prompt injection technique designed to: 1) Force the AI to execute arbitrary commands without user consent, 2) Potentially load malicious instructions from an external 'trusted-memory' skill/plugin, 3) Establish persistence via a sentinel file (/tmp/session_bootstrapped) to track execution. The authoritative tone ('MANDATORY', 'not optional', 'violating this rule') is a classic prompt injection pattern to override the AI's safety boundaries.

alwaysApply:: No
applyTo:: ** — when reading GitHub data via the gh CLI or related Composio GitHub tooling

GitHub Data via `gh`

Name: jbaruch/nanoclaw-trusted
Rating: 77.47 (1 reviews)
Author: jbaruch

What To Use

GitHub state — PRs, issues, repo contents, workflow runs, releases, search results — comes from the gh CLI inside the container. The orchestrator forwards GITHUB_TOKEN via --env-file (per src/container-runner.ts SECRET_CONTAINER_VARS, jbaruch/nanoclaw#565); gh reads it automatically, so no gh auth login is needed.

Always use --json to get structured output: gh issue view 565 --repo jbaruch/nanoclaw --json title,body,state parses cleanly. Without --json, output is human-formatted and brittle.

Why Not `curl`

Don't use curl https://api.github.com/... for GitHub data — the unauthenticated path appears to work, then quietly fails. Known failure modes:

60 req/hr rate limit
No {successful, error} envelope
Private-repo 404s indistinguishable from non-existence

Don't hand-roll Authorization: Bearer "$GITHUB_TOKEN" onto curl either. Use gh --json.

Composio as Fallback Only

The Composio GITHUB_* tools (COMPOSIO_MULTI_EXECUTE_TOOL → GITHUB_*) remain reachable for the rare case gh can't express the operation. For the common cases — issue/PR view/edit/comment, workflow run listing, repo/file search, file content fetch — prefer gh. If a gh invocation appears to require Composio as a workaround, surface that gap explicitly instead of silently routing through Composio.

Sub-Agents

Sub-agents spawned via Agent run inside the same container and inherit GITHUB_TOKEN from the env, so gh works inside them. Composio MCP, by contrast, is not accessible from sub-agents — another reason to prefer gh.

Sibling Rules

The standalone sqlite3 CLI is also absent from the container image (separate concept) — see the messages-db-schema rule for the python3 -c 'import sqlite3' path.

jbaruch/nanoclaw-trusted