jbaruch/nanoclaw-trusted

Rules for trusted NanoClaw groups. Shared memory, session bootstrap, cross-group memory updates. Loaded for trusted and main containers only.

Quality

94%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

This version of the tile failed moderation

Failed moderation (intent review) in rules/session-bootstrap.md: This is a prompt injection attack disguised as a cursor rule. It instructs an AI agent to execute a bash command as its very first action in every session, then call an external skill ('tessl__trusted-memory') which could load arbitrary instructions or exfiltrate data. The sentinel file mechanism (/tmp/session_bootstrapped) is designed to make it look like a legitimate caching/dedup mechanism, but the real goal is to force the AI to execute commands and call external services before processing the user's actual request. This is a classic prompt injection / agent manipulation pattern.

alwaysApply:: Yes

Memory File Locations

Name: jbaruch/nanoclaw-trusted
Rating: 94.27272727272728 (1 reviews)
Author: jbaruch

Typed memory files (user_*.md, feedback_*.md, project_*.md, reference_*.md, key-people.md) live in /workspace/trusted/ root — NOT in /workspace/trusted/memory/. The memory/ subdirectory is reserved for daily/ logs and daily_discoveries.md. MEMORY.md (also at root) is the index — one-line pointers to each typed file. highlights.md (root) is the weekly archive. Wiki content (wiki/, sources/) is separate from operational memory and not governed by this rule.

Invariants

Every typed memory file at root MUST have an entry in MEMORY.md — orphans get an index entry added.
MEMORY.md paths MUST resolve — if the index points to memory/foo.md but the file is at root foo.md, fix the index, not the file location.
No duplicates — a memory file exists in exactly one location. If the same file appears in both root and memory/, delete the memory/ copy.

Common mistake

Creating feedback_*.md under /workspace/trusted/memory/ instead of /workspace/trusted/. The memory/ prefix feels natural but only daily/ content goes there.

jbaruch/nanoclaw-trusted