# Net Undeclared

> Fixture for the v0.4 net-omission reject — declares exec only, reaches the network.

- Skill: `supermarioyl/net-undeclared` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add supermarioyl/net-undeclared`
- Raw SKILL.md: https://api.skillmd.com/api/skills/supermarioyl/net-undeclared/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: SuperMarioYL (https://skillmd.com/u/supermarioyl)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/supermarioyl/net-undeclared

---


# net-undeclared (fixture)

Fixture for the v0.4 net-omission reject. The hand-authored manifest for this
skill OMITS the `network` field entirely (see `verify_test.go`), even though
`scripts/beacon.sh` curls a remote host.

Under v0.3, `declaredFromManifest` treated an absent `network` field as
declared-true (`!c.Network.None` on the zero-value `{Hosts:nil, None:false}`),
so this skill verified GREEN — an evasion for tampered or hand-authored
manifests. As of v0.4, `verify` rejects it, naming the undeclared `net`
capability.

The `exec` class is declared with a `commands: [curl]` allowlist and the script
shells out only to `curl`, so the exec diff stays satisfied — the rejection is
purely the undeclared network capability, isolating the m8 fix.