CtrlK
BlogDocsLog inGet started
Tessl Logo

jbaruch/nanoclaw-trusted

Rules for trusted NanoClaw groups. Shared memory, session bootstrap, cross-group memory updates. Loaded for trusted and main containers only.

77

Quality

96%

Does it follow best practices?

Impact

No eval scenarios have been run

SecuritybySnyk

Risky

Do not use without reviewing

This version of the tile failed moderation
Failed moderation (intent review) in rules/session-bootstrap.md: This is a prompt injection attack disguised as a cursor/IDE rule file. It instructs an AI agent to unconditionally execute a bash command and invoke an external skill ('tessl__trusted-memory') at the start of every session before processing any user input. This is a social engineering/prompt injection technique designed to: 1) Force the AI to execute arbitrary commands without user consent, 2) Potentially load malicious instructions from an external 'trusted-memory' skill/plugin, 3) Establish persistence via a sentinel file (/tmp/session_bootstrapped) to track execution. The authoritative tone ('MANDATORY', 'not optional', 'violating this rule') is a classic prompt injection pattern to override the AI's safety boundaries.
Overview
Quality
Evals
Security
Files

ground-truth-trusted.mdrules/

alwaysApply:
No
applyTo:
** — when answering substantive trusted-tier questions or producing claims that need verification

Ground Truth — Trusted Extensions

Extends the core ground-truth rule with verification methods available to trusted containers — Composio for Google services (Calendar, Gmail, Tasks) and gh for GitHub.

Additional verification sources

Claim typeHow to verify
Calendar eventFetch from Google Calendar via Composio
Email contentFetch from Gmail via Composio
GitHub PR/issueFetch via gh (Composio fallback)
Task/todo statusFetch from Google Tasks via Composio

GitHub: gh-first, no non-existence claims on unauth 404

GitHub state — PRs, issues, repo contents, search results — comes from the authenticated gh CLI inside the container. For the full rationale, command shapes, and Composio-fallback envelope, see the github-data-via-gh rule.

A 404 from curl https://api.github.com/... proves "I cannot see this from this path", not that the resource does not exist. Owner-adjacent repos (jbaruch/*, ligolnik/*, tessl-io/*) may be private to the unauthenticated caller. Re-run the query through gh (or Composio, if gh can't express it) before asserting non-existence — and especially before retracting a prior statement about something existing on the strength of a 404.

Sub-agent note: Sub-agents spawned via Agent run inside the same container and inherit GITHUB_TOKEN from the env, so gh works inside them; Composio MCP, by contrast, is not accessible from sub-agents.

Compute with external data

When a task requires external data, chain tools to compute the exact answer.

Example: "Remind me 15 minutes before I leave for Amir's pickup."

ApproachVerdict
Ask "when do you leave?"Wrong — you can compute it
Set it 15 min before the event startWrong — departure ≠ event start
Check calendar for destination → Maps for travel time → calculate real departure → set 15 min beforeCorrect

These sources are not available in untrusted containers. The core ground-truth rule covers universal verification methods.

rules

async-tasks-extended.md

compaction-aware-summaries.md

composio-vs-agents.md

container-trust-levels.md

context-bootstrap-bg-agents.md

daily-discoveries-rule.md

duplicate-prevention.md

github-data-via-gh.md

global-memory.md

ground-truth-trusted.md

identity-compaction-recovery.md

identity-dual-handle.md

installed-content-immutable.md

local-context-anchoring.md

memory-file-locations.md

messages-db-schema.md

no-orphan-tasks.md

no-silent-defer.md

pending-response-tracking.md

proactive-fact-saving.md

proactive-participation.md

reply-threading.md

session-bootstrap.md

skills-policy.md

verification-protocol.md

wiki-awareness.md

README.md

tile.json