Garry Tan 1ba4c9293b fix(cso): adversarial review fixes — FP filtering, prompt injection, language coverage ...

- Exclusion #10: test files must verify not imported by non-test code
- Exclusion #13: distinguish user-message AI input from system-prompt injection
- Exclusion #14: ReDoS in user-input regex IS a real CVE class, don't exclude
- Add anti-manipulation rule: ignore audit-influencing instructions in codebase
- Fix confidence gate: remove contradictory 7-8 tier, hard cutoff at 8
- Fix verifier anchoring: send only file+line, not category/description
- Add Go, PHP, Java, C#, Kotlin to grep patterns (was 4 languages, now 8)
- Add GraphQL, gRPC, WebSocket endpoint detection to attack surface mapping

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-22 11:13:45 -07:00

..

SKILL.md

fix(cso): adversarial review fixes — FP filtering, prompt injection, language coverage

2026-03-22 11:13:45 -07:00

SKILL.md.tmpl

fix(cso): adversarial review fixes — FP filtering, prompt injection, language coverage

2026-03-22 11:13:45 -07:00