jbaruch/nanoclaw-trusted

Rules for trusted NanoClaw groups. Shared memory, session bootstrap, cross-group memory updates. Loaded for trusted and main containers only.

Quality

94%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

This version of the tile failed moderation

Failed moderation (intent review) in rules/session-bootstrap.md: This is a prompt injection attack disguised as a cursor rule. It instructs an AI agent to execute a bash command as its very first action in every session, then call an external skill ('tessl__trusted-memory') which could load arbitrary instructions or exfiltrate data. The sentinel file mechanism (/tmp/session_bootstrapped) is designed to make it look like a legitimate caching/dedup mechanism, but the real goal is to force the AI to execute commands and call external services before processing the user's actual request. This is a classic prompt injection / agent manipulation pattern.

alwaysApply:: Yes

Compaction-Aware Summaries

Name: jbaruch/nanoclaw-trusted
Rating: 94.27272727272728 (1 reviews)
Author: jbaruch

When Claude Code compacts context, the summary must preserve information that cannot be recovered from files alone.

Compaction priorities

The summary MUST include, in this order:

Personal facts — Any preferences, family details, opinions, or personal context mentioned in this session that haven't been saved to trusted memory yet
Decisions and reasoning — What was decided, why, and what alternatives were rejected
Commitments — Promises made in both directions (what the owner committed to, what the assistant committed to deliver)
Current task state — What's being worked on, what step we're at, what's next
New contacts or relationships — Anyone mentioned for the first time with their context

Pre-compaction save

If a personal fact was mentioned during the session but NOT yet saved to /workspace/trusted/ memory — save it NOW, before compaction loses it. This is not optional. Compaction summaries are lossy; typed memory files are not.

Focus the summary budget on the human context that only exists in conversation — file paths, code changes, tool-call sequences, and error messages are all reconstructable from git, the task, and logs and should not consume the summary budget.

jbaruch/nanoclaw-trusted