circle-ir-ai 4.11.1 → 4.12.0

package/CHANGELOG.md

@@ -7,6 +7,103 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.12.0] - 2026-09-11
+
+### Changed
+
+- **circle-ir 4.9.10 → 4.9.13.** Picks up four upstream fixes that were published after the
+  4.9.10 tag: the CLI dedupe from cognium-dev#305, three precision fixes from #317, and the
+  cross-method alias fix from #318. Verified against the class that prompted the upgrade —
+  `RegExp.exec` no longer yields a `command_injection` sink, which is the fourth shape of
+  cognium-ai#419 (the other three were ours and are fixed below). Exactly one copy of
+  `circle-ir` resolves in the tree; full suite unchanged at 2,205 passing.
+
+### Fixed
+
+- **`enableLLM` also gates the SKILL.md natural-language extractor (cognium-ai#405 residual).**
+  The gate shipped covering instruction-safety and capability-mismatch, but
+  `NaturalLanguageExtractor.extractSemanticFacts()` is a **third** LLM caller and it runs during
+  artifact extraction, *before* either gate is consulted — so `--no-llm` still printed the
+  unreachable-endpoint warning. Found while validating this release. Skipping it is safe: the
+  extractor already degrades to an empty result when the LLM is unavailable, and the only
+  consumer of the SKILL.md IR is the capability-mismatch comparison, which `enableLLM: false`
+  switches off anyway.
+
+### Added
+
+- **`enableLLM` master switch for `analyzeSkillBundle` (cognium-ai#405).** `enableLLM: false`
+  means no phase may reach the network. `enableInstructionSafety: false` alone did not cover
+  it: the capability-mismatch comparison is a **second** LLM caller in the same pipeline and
+  was ungated, so a run with instruction-safety off still attempted a connection and printed
+  the unreachable-endpoint warning. Defaults to `true`, so existing callers are unaffected.
+
+### Fixed
+
+- **Skills engine precision — the five deterministic classes from the SR skillharness review
+  (cognium-ai#416, #417, #418, #420, #427).**
+  - **#416** `codebase_exfiltration` fired on `vercel-deploy-claimable`'s `deploy.sh`, which tars the
+    project and POSTs it to `api.vercel.com` with the operator's own token — the product, not
+    exfiltration. `isDeclaredDeployUpload` now suppresses it when **both** hold: every absolute host
+    in the file is a known deploy/publish endpoint, and the skill declares that intent in its own
+    SKILL.md. Either condition alone would be exploitable, so both are required; an archive that also
+    reaches any other host still fires.
+  - **#417** `trigger_hijack` read the documentation checkbox `- [ ] [Create todos for all tasks]` as
+    an auto-attach claim. `for all tasks` now needs a skill-activation subject within 40 characters
+    (the #352-pass-2 rule), and fenced blocks and `- [ ]` task-list items are excluded — an example
+    being shown is not a declaration.
+  - **#418** `broken_reference` fired on a page-template link inside a fenced block. New `fenceMask`
+    drops reference positions inside ``` / ~~~ fences.
+  - **#420 (a false negative)** a backticked sibling directory such as `` `../using-superpowers/references/` ``
+    escaped the bundle root but was invisible: the extension test and the `rootPath` requirement both
+    hid it, so `obra/executing-plans` returned zero findings. An escaping path is now a reference on
+    the strength of the string alone — whether it exists on disk is irrelevant to whether it escapes.
+  - **#427 (structural)** 616 of the 2,265 Milestone-1 CRITICAL/HIGH rows name no file at all: they
+    are matchers over SKILL.md prose. skillsregistry#85 already established that an instruction read
+    must never flip the verdict alone; these matchers are deterministic, so they lack #85's
+    reproducibility problem but share its epistemic one — a prose read is a claim about what a skill
+    *says*, a taint finding is a claim about what its code *does*. The four behaviour-claim detectors
+    (`trigger_hijack`, `invisible_characters`, `multimodal_payload`, `financial_access`) no longer flip
+    the verdict to VULNERABLE without a code-backed finding corroborating. They still surface and still
+    penalise `trust_score`. Scoped to claims: an encoded payload or hidden instruction in SKILL.md is an
+    artifact present in the text and keeps flipping. Kill switch `SKILL_PROSE_VERDICT_GUARD=0`.
+- **Skills engine — a sink is not a finding (cognium-ai#419).** `extractFindingsFromIR`
+  emitted one `vulnerability` per entry in circle-ir's sink **inventory**, with no
+  source→sink flow required, so we published sinks that circle-ir itself did not consider
+  findings. That is why the SkillsRegistry harness saw `code_injection` on
+  `setTimeout(connect, 250)` — a function reference — and `xss` on a static `cssText`
+  literal, while the SAST team measured circle-ir silent on the same fixtures at the exact
+  version tested. Reproduced here with the LLM off, so it is not an enrichment artefact.
+  The emission now goes through circle-ir's own `generateFindings(sources, sinks, dfg, …)`,
+  which applies the source→sink compatibility check the cross-product skipped — the same
+  unification CLAUDE.md records as the open design gap on the mastra `runReport` path. A
+  real request-param → `exec()` flow still reports; the code-threat detectors are a separate
+  path and are unaffected, so a hardcoded malicious command with no tainted source still
+  fires there. A join failure falls back to the sink list rather than silently dropping
+  findings. Kill switch `SKILL_SINK_FLOW_GUARD=0`.
+
+### Fixed
+
+- **Skills engine precision — `credential_exfiltration` no longer fires on co-presence
+  (cognium-ai#412).** The CWE-522 detector asserted exfiltration whenever a credential path
+  appeared anywhere in a file that also contained an egress token anywhere else. It was 208 of
+  the 2,265 Milestone-1 CRITICAL/HIGH rows; SR resolved 40 of them to source at HEAD and not one
+  was exfiltration. Four gates now apply, in the order that clears the most: the path must be in
+  real code (not a comment, not a JSON-schema `description`, not prose); it must not be a guard's
+  own denylist entry; it must not be the skill's own token store under its own config directory;
+  and the read must reach an egress call, by position or through the identifier it was assigned
+  to. `danduh/mcp-security`, the single certified true positive in the cohort, still fires.
+- **Skills engine precision — the inverted-detection class, generalised (cognium-ai#414).** #370
+  gated quoted literals inside denylist arrays for two detectors. SR then scanned all 1,649
+  findings naming a concrete file for three high-specificity families — recursive delete (11),
+  cryptominer pool (3), wallet seed phrase (5) — and every one of the 19 was inverted: a
+  scanner's own rule catalogue, a jail's denylist, a defensive comment, or a test asserting
+  rejection. `inDefensiveContext()` now covers rule catalogues and message tables, comments
+  including trailing ones, defensive vocabulary and assertions nearby, and applies to every
+  code-threat detector except `hardcoded_secret`. Suppression turns on whether the match is
+  *inert* — present only inside a literal on a line whose code half calls nothing that runs or
+  sends — never on the filename, so a genuine `exec("rm -rf /")` still fires from
+  `src/security/policy.ts`.
+
 ## [4.11.1] - 2026-09-09
 
 Patch: the thinking-model timeout allowance introduced in 4.11.0 was global, so a

package/dist/skills/code-threat-patterns.d.ts

@@ -38,6 +38,34 @@ import type { SkillBundle, SkillFinding } from './types.js';
 export declare function buildCommentMask(lines: string[], path?: string): boolean[];
 /** Blank out string and regex literals so a token like `eval(` inside `'eval('` or `/\\beval\\s*\\(/` is not read as code. */
 export declare function stripLiterals(line: string): string;
+export declare function inDefensiveContext(lines: string[], mask: boolean[], i: number, _path?: string, match?: string, radius?: number): boolean;
+/**
+ * A JSON-schema / tool-parameter `description` string (cognium-ai#412): the credential path is
+ * documentation of a parameter, not a read. `"key_file": { "description": "Path to SSH private key
+ * file (e.g. ~/.ssh/id_rsa)" }`.
+ */
+export declare function isSchemaDescription(line: string): boolean;
+/**
+ * The path appears only inside a sentence — three or more words around it in one literal — so it is
+ * being *talked about*, not opened ("No credentials stored in Reqly"). Same rule `pathIsWritten`
+ * applies to memory files, lifted so the credential class can use it too (cognium-ai#412).
+ */
+export declare function isProseMention(line: string, pathRe: RegExp): boolean;
+/**
+ * The skill's OWN credential store (cognium-ai#412): a path under the product's own config
+ * directory — `~/.config/<product>/credentials.json`, `~/.<product>/credentials.json`,
+ * `os.homedir()/.config/<product>/…`, or a path built from a CONFIG_DIR/APP_DIR identifier.
+ * Reading and writing your own OAuth token file is what every OAuth client does; it is not
+ * exfiltration, whatever else the file happens to contain.
+ */
+export declare function isOwnCredentialStore(line: string): boolean;
+/**
+ * The credential read reaches egress (cognium-ai#412). Co-presence in one file is not enough — the
+ * SR cohort is full of files that read their own config and, elsewhere, call the product's own API.
+ * Egress must be on the same line, within a short radius of the read, or reached through the
+ * identifier the read was assigned to.
+ */
+export declare function readReachesEgress(lines: string[], mask: boolean[], at: number, readOp: RegExp, radius?: number): boolean;
 export declare function inDenylistContext(lines: string[], i: number, radius?: number): boolean;
 /**
  * skillsregistry#72 — decode the literals a runtime would decode, so the
@@ -57,6 +85,13 @@ export declare function decodeEncodedLiterals(content: string): {
  * ordinary rendering (leading BOM, emoji ZWJ sequences). Exported for tests.
  */
 export declare function covertInvisibleCodepoints(text: string): string[];
+/**
+ * Lines inside a fenced markdown block (``` or ~~~), for SKILL.md prose detectors.
+ * A fenced block is an example being *shown* — a template, a sample header, a command
+ * transcript — not something the skill asserts about itself (cognium-ai#417 / #418).
+ */
+export declare function fenceMask(lines: string[]): boolean[];
+export declare function isDeclaredDeployUpload(content: string, skillMd?: string): boolean;
 /** The always-on / auto-attach claim in a text (SKILL.md or a listing description), or null. Shared with the marketplace scanner (SR-D2 / #260). */
 export declare function alwaysOnClaim(text: string): string | null;
 export declare const NARROW_CLAIM: RegExp;

package/dist/skills/code-threat-patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-threat-patterns.d.ts","sourceRoot":"","sources":["../../src/skills/code-threat-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,YAAY,CAAC;AA4Q9E,+DAA+D;AAK/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,SAAK,GAAG,OAAO,EAAE,CAkCtE;AAED,8HAA8H;AAC9H,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AASD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAOjF;AAmHD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,YAAY,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AASD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,eAAe,EAAE,CAAA;CAAE,CA8BvF;AA63BD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBhE;AA6ID,oJAAoJ;AACpJ,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzD;AA6BD,eAAO,MAAM,YAAY,QAA2H,CAAC;AACrJ,eAAO,MAAM,UAAU,QAAiF,CAAC;AAyOzG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBzD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,YAAY,GAAG,YAAY,CAYzE;AA2DD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CAuDxE;AAiKD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CA2D5E"}
+{"version":3,"file":"code-threat-patterns.d.ts","sourceRoot":"","sources":["../../src/skills/code-threat-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,YAAY,CAAC;AA4Q9E,+DAA+D;AAK/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,SAAK,GAAG,OAAO,EAAE,CAkCtE;AAED,8HAA8H;AAC9H,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAyED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,OAAO,EAAE,EACf,CAAC,EAAE,MAAM,EACT,KAAK,SAAK,EACV,KAAK,SAAK,EACV,MAAM,SAAI,GACT,OAAO,CA0BT;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAWpE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAkBnH;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAOjF;AAmHD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,YAAY,GAAG,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AASD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,eAAe,EAAE,CAAA;CAAE,CA8BvF;AA65BD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBhE;AA2HD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAYpD;AAoBD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAKjF;AAuBD,oJAAoJ;AACpJ,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMzD;AAkCD,eAAO,MAAM,YAAY,QAA2H,CAAC;AACrJ,eAAO,MAAM,UAAU,QAAiF,CAAC;AAyOzG;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAqBzD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW7D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,YAAY,GAAG,YAAY,CAYzE;AA2DD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CA8ExE;AAiKD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CA2D5E"}

package/dist/skills/code-threat-patterns.js

@@ -340,6 +340,172 @@ export function stripLiterals(line) {
 // in an injection defence. The tell is a nearby identifier or membership test.
 const DENYLIST_IDENT = /(?<![A-Za-z])(?:marker|pattern|signature|block(?:ed|list)?|deny|ban(?:ned)?|forbid(?:den)?|danger(?:ous)?|risk[a-z]*|detect[a-z]*|scan[a-z]*|blacklist|disallow[a-z]*|suspicious|unsafe|malicious|guard|filter|sanitiz[a-z]*|validat[a-z]*)(?![a-z])/i; // `HIGH_RISK_MARKERS`: `_` is a word char, so no \b
 const MEMBERSHIP_TEST = /\.(?:includes|test|match|search|indexOf|some|find)\s*\(|\bre\.(?:search|match|compile|findall)\s*\(|\bany\s*\(|\s(?:not\s+)?in\s+[A-Z_a-z]/;
+/**
+ * cognium-ai#414 — the inverted-detection class, generalised past #370's literal denylists.
+ * SR scanned all 1,649 Milestone-1 findings naming a concrete file and tested three
+ * high-specificity signature families at HEAD: recursive-delete (11), cryptominer pool (3),
+ * wallet seed phrase (5). All 19 were inverted — a scanner's own rule catalogue, a jail's
+ * denylist, a defensive comment, or a test asserting rejection. The cohort this hits hardest
+ * is exactly the security tools a trust registry should be ranking highest.
+ *
+ * Four shapes, matching the four in the ticket:
+ *   1. a rule catalogue / message table / indicator list (identifier OR rule-shaped field);
+ *   2. a comment — including a trailing one — since a comment never executes;
+ *   3. a guard / validator / policy / scanner by path, or an assertion on the construct;
+ *   4. a test or benchmark fixture.
+ *
+ * Every branch except the comment one also requires the match to be INERT: present only inside
+ * a string or regex literal on a line whose code half calls nothing live. That is what keeps a
+ * genuine `exec("rm -rf /")` or `fetch(url, { body: readFileSync('~/.aws/credentials') })`
+ * firing even when it sits in a file called `security.ts`.
+ */
+const DEFENSIVE_IDENT = /(?<![A-Za-z])(?:catalog(?:ue)?|indicator|ioc|policy|policies|guard|jail|sandbox|validator|validate|sanitiz|reject|refuse|severity|advisor|remediat|mitigat|malware|malicious|suspicious|threat|audit|lint|rule)/i;
+/** A rule-catalogue FIELD: the match is a value under a documentation-shaped key. */
+const RULE_FIELD = /["']?(?:message|msg|label|title|description|detail|name|id|sev|severity|pattern|regex|re|test|indicator|rule|hint|reason|advice|remediation)["']?\s*[:=]/i;
+/** An assertion — a test proving the guard rejects the construct. */
+const ASSERTION = /\b(?:assert\w*|expect|should|must_fail|is_err|to(?:Throw|Be|Equal)|panics|refute)\b/;
+/** A live call: the literal on this line is an ARGUMENT to something that runs or sends. */
+const LIVE_SINK = /\b(?:exec\w*|spawn\w*|system|popen|Popen|check_output|check_call|eval|Function|shell_exec|passthru|Invoke-Expression|iex)\s*\(|\bsubprocess\b|\bshutil\.rmtree\b|\bos\.(?:system|remove|unlink|rmdir)\s*\(|\bChild(?:Process)?\b/;
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Index at which a line comment starts outside any string literal, or -1. */
+function commentStart(line) {
+    let q = null;
+    // A leading `#!` is a shebang, not a comment opener.
+    for (let i = /^#!/.test(line) ? 2 : 0; i < line.length; i++) {
+        const c = line[i];
+        if (q) {
+            if (c === '\\')
+                i++;
+            else if (c === q)
+                q = null;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            q = c;
+            continue;
+        }
+        // `//` in `https://` is a scheme, not a comment; `--data-binary` is a flag, not SQL.
+        if (c === '#' || (c === '/' && line[i + 1] === '/' && line[i - 1] !== ':'))
+            return i;
+    }
+    return -1;
+}
+/**
+ * The match is inert: it survives only inside a literal, and the code half of the line calls
+ * nothing that runs or sends. A rule catalogue entry is inert; `exec(payload)` is not.
+ */
+function isInertLiteral(line, match) {
+    if (!match)
+        return false;
+    const re = new RegExp(escapeRe(match));
+    if (!onlyInLiteral(line, re))
+        return false;
+    const code = stripLiterals(line);
+    return !LIVE_SINK.test(code) && !NETWORK_EGRESS.test(code);
+}
+export function inDefensiveContext(lines, mask, i, _path = '', match = '', radius = 6) {
+    const line = lines[i] ?? '';
+    // 2 — a comment never executes. Block comments and docstrings come from the #370 mask;
+    // a trailing comment is caught by position.
+    // A shebang is an interpreter selection, not a comment — and some detectors anchor their
+    // hit to it (`#!/usr/bin/env bash` for an env-harvesting script).
+    if ((mask[i] || isCommentOrDoc(line)) && !/^\s*#!/.test(line))
+        return true;
+    if (match) {
+        const at = line.indexOf(match);
+        const cs = commentStart(line);
+        if (at >= 0 && cs >= 0 && at > cs)
+            return true;
+    }
+    const inert = isInertLiteral(line, match);
+    if (!inert)
+        return false;
+    // 1 — rule catalogue, message table, indicator list, denylist (the #370 gate widened).
+    if (inDenylistContext(lines, i, radius))
+        return true;
+    if (RULE_FIELD.test(line))
+        return true;
+    // 3 + 4 — a guard / validator / policy / scanner, or a test asserting rejection. Judged by the
+    // code around the match, never by the filename alone: `src/security/collect.ts` is exactly where
+    // a real infostealer would put itself.
+    const lo = Math.max(0, i - radius);
+    const hi = Math.min(lines.length - 1, i + radius);
+    for (let k = lo; k <= hi; k++) {
+        if (ASSERTION.test(lines[k]) || DEFENSIVE_IDENT.test(lines[k]))
+            return true;
+    }
+    return false;
+}
+/**
+ * A JSON-schema / tool-parameter `description` string (cognium-ai#412): the credential path is
+ * documentation of a parameter, not a read. `"key_file": { "description": "Path to SSH private key
+ * file (e.g. ~/.ssh/id_rsa)" }`.
+ */
+export function isSchemaDescription(line) {
+    return /["']?(?:description|title|help|placeholder|example|hint|doc)["']?\s*[:=]\s*["'`]/.test(line);
+}
+/**
+ * The path appears only inside a sentence — three or more words around it in one literal — so it is
+ * being *talked about*, not opened ("No credentials stored in Reqly"). Same rule `pathIsWritten`
+ * applies to memory files, lifted so the credential class can use it too (cognium-ai#412).
+ */
+export function isProseMention(line, pathRe) {
+    const m = pathRe.exec(line);
+    if (!m)
+        return false;
+    const q = /(["'`])((?:\\.|(?!\1)[^\\\n])*)\1/g;
+    let lit;
+    while ((lit = q.exec(line))) {
+        if (lit.index <= m.index && m.index < lit.index + lit[0].length) {
+            return lit[2].trim().split(/\s+/).length >= 3 && !/[\/\\]/.test(lit[2].trim().split(/\s+/)[0]);
+        }
+    }
+    return false;
+}
+/**
+ * The skill's OWN credential store (cognium-ai#412): a path under the product's own config
+ * directory — `~/.config/<product>/credentials.json`, `~/.<product>/credentials.json`,
+ * `os.homedir()/.config/<product>/…`, or a path built from a CONFIG_DIR/APP_DIR identifier.
+ * Reading and writing your own OAuth token file is what every OAuth client does; it is not
+ * exfiltration, whatever else the file happens to contain.
+ */
+export function isOwnCredentialStore(line) {
+    if (/\b(?:CONFIG_DIR|CONFIG_PATH|APP_DIR|APP_CONFIG|DATA_DIR|STATE_DIR|CACHE_DIR|configDir|appDir|dataDir)\b/.test(line))
+        return true;
+    // ~/.config/<name>/… or ~/.<name>/… — a named product directory, not a third party's dotfile.
+    return /(?:~|\$HOME|homedir\(\)|Path\.home\(\)|process\.env\.HOME|os\.path\.expanduser)[^\n]*?[\/'"`,\s]\.?config[\/'"`,\s]+[\w.-]+[\/'"`,\s]/.test(line)
+        || /(?:~|\$HOME|homedir\(\)|Path\.home\(\)|process\.env\.HOME|os\.path\.expanduser)[^\n]*?[\/'"`,\s]\.[\w-]{2,}[\/'"`,\s]+(?:credentials?|token|auth)[\w.-]*\.json/i.test(line);
+}
+/**
+ * The credential read reaches egress (cognium-ai#412). Co-presence in one file is not enough — the
+ * SR cohort is full of files that read their own config and, elsewhere, call the product's own API.
+ * Egress must be on the same line, within a short radius of the read, or reached through the
+ * identifier the read was assigned to.
+ */
+export function readReachesEgress(lines, mask, at, readOp, radius = 4) {
+    const code = (k) => !mask[k] && !isCommentOrDoc(lines[k]);
+    const line = lines[at];
+    if (NETWORK_EGRESS.test(line))
+        return true;
+    const isRead = readOp.test(line);
+    for (let k = Math.max(0, at - radius); k <= Math.min(lines.length - 1, at + radius); k++) {
+        if (k !== at && code(k) && NETWORK_EGRESS.test(lines[k]) && (isRead || readOp.test(lines[k])))
+            return true;
+    }
+    // `creds = open(path).read()` … later `fetch(url, { body: creds })`
+    const assign = /^\s*(?:(?:const|let|var|val|my|local|export)\s+)?([A-Za-z_$][\w$]*)\s*(?::\s*[\w<>\[\]|.]+)?\s*=[^=]/.exec(line);
+    if (assign && isRead) {
+        const id = assign[1].replace(/\$/g, '\\$');
+        const used = new RegExp(`\\b${id}\\b`);
+        for (let k = at + 1; k < lines.length; k++) {
+            if (code(k) && used.test(lines[k]) && NETWORK_EGRESS.test(lines[k]))
+                return true;
+        }
+    }
+    return false;
+}
 export function inDenylistContext(lines, i, radius = 6) {
     const lo = Math.max(0, i - radius);
     const hi = Math.min(lines.length - 1, i + radius);
@@ -519,7 +685,7 @@ function scanFile(path, content, ctx) {
         (/\btarfile\.open\s*\(/.test(content) && /\.add\s*\(\s*(?:pathlib\.Path\s*\(\s*['"]\.['"]\s*\)|['"]\.['"]|os\.getcwd\s*\(\s*\)|Path\.cwd\s*\(\s*\))/.test(content)) ||
         (/\bzipfile\.ZipFile\s*\(/.test(content) && /os\.walk\s*\(\s*(?:['"]\.['"]|os\.getcwd\(\)|Path\.cwd\(\))/.test(content)) ||
         /\b(?:archiver|tar)\s*\.\s*(?:c|create|directory)\s*\([^\n]*['"](?:\.|\.\/|process\.cwd\(\))['"]?/.test(content);
-    if (archivesWorkspace && fileHasEgress) {
+    if (archivesWorkspace && fileHasEgress && !isDeclaredDeployUpload(content, ctx?.skillMd)) {
         const line = firstLineMatching(lines, /git\s+archive|tar\s+|zip\s+-r|make_archive/i);
         hits.push({
             key: 'codebase_exfiltration',
@@ -778,17 +944,50 @@ function scanFile(path, content, ctx) {
     // hosts, .netrc) AND ships it out. A skill that reads credentials without
     // egress, or has egress without a credential read, does not fire.
     {
+        // cognium-ai#412 (SR full-cohort, 208/2,265 rows): this fired on CO-PRESENCE — a credential
+        // path anywhere in the file plus an egress token anywhere else. Of 40 rows resolved to source
+        // by the SR team, NONE was exfiltration: a skill's own OAuth store (`~/.config/<product>/
+        // credentials.json`), a filesystem jail whose denylist contains `id_rsa`, a JSON-schema
+        // `description` naming `~/.ssh/id_rsa`, and the sentence "No credentials stored in Reqly".
+        //
+        // The discriminator, from the one certified TP (`danduh/mcp-security`): the credential is
+        // READ and the read REACHES an egress call. Four gates, in order of how much they clear:
+        //   1. the path must be in real code — not a comment, not a JSON-schema description, and not
+        //      prose (`stripLiterals` + the comment mask + the prose rule).
+        //   2. not a denylist / guard entry — `inDenylistContext`, the #414 inverted-detection class.
+        //   3. not the skill's OWN credential store — a path under the product's own config dir.
+        //   4. the read must reach egress: same line, within a short radius, or via the identifier the
+        //      read was assigned to. Co-presence alone no longer fires.
         const CRED_FILE = /\.aws\/credentials|\.ssh\/id_(rsa|ed25519|dsa)\b|\.config\/gh\/hosts|\.netrc\b|\/etc\/(shadow|passwd)\b|\bcredentials\.json\b|\.docker\/config\.json/i;
-        if (CRED_FILE.test(content) && fileHasEgress) {
-            const at = firstLineMatching(lines, CRED_FILE);
+        const READ_OP = /\b(?:open|read_text|read_bytes|readFile|readFileSync|read|load|loads|cat|Get-Content|File\.(?:read|open)|fs\.read)\w*\s*\(|\bwith\s+open\s*\(|<\s*["'`]?[~/$][^\s"'`]*\.(?:pem|json)\b/;
+        for (let i = 0; i < lines.length; i++) {
+            const raw = lines[i];
+            if (!CRED_FILE.test(raw))
+                continue;
+            // 1 — real code only. A path that survives only inside a literal still counts (that is how
+            // paths are written), but a commented line, a doc line, or a schema description does not.
+            if (mask[i] || isCommentOrDoc(raw) || isSchemaDescription(raw))
+                continue;
+            if (isProseMention(raw, CRED_FILE))
+                continue;
+            // 2 — a guard's own denylist entry is not an exfiltration (cognium-ai#414).
+            if (inDenylistContext(lines, i))
+                continue;
+            // 3 — the skill reading its OWN token store is every OAuth client on earth.
+            if (isOwnCredentialStore(raw))
+                continue;
+            // 4 — the read has to reach egress.
+            if (!readReachesEgress(lines, mask, i, READ_OP))
+                continue;
             hits.push({
                 key: 'credential_exfiltration',
-                line: at.n,
-                snippet: at.text,
-                match: at.match,
+                line: i + 1,
+                snippet: raw.trim().slice(0, 200),
+                match: (CRED_FILE.exec(raw) ?? [''])[0].slice(0, 80),
                 confidence: 0.9,
-                detail: 'reads local credential files and sends them to a network endpoint',
+                detail: 'reads a local credential file and the read reaches a network egress call',
             });
+            break;
         }
     }
     // ---- SR#14 config_injection ------------------------------------------
@@ -1195,7 +1394,11 @@ function scanFile(path, content, ctx) {
             detail: 'embedded PEM private key material',
         });
     }
-    return hits.map((h) => hitToFinding(path, h));
+    // cognium-ai#414 — drop the inverted class before it becomes a finding. `hardcoded_secret`
+    // is exempt: real key material in a fixture is still real key material.
+    return hits
+        .filter((h) => h.key === 'hardcoded_secret' || !inDefensiveContext(lines, mask, (h.line ?? 1) - 1, path, h.match ?? ''))
+        .map((h) => hitToFinding(path, h));
 }
 // A PEM PRIVATE KEY header immediately followed (within a few chars/newlines)
 // by a long base64 body run — i.e. real key material, not a doc header mention.
@@ -1470,6 +1673,55 @@ function scanMultimodalDeference(skillMd) {
         },
     ];
 }
+/**
+ * Lines inside a fenced markdown block (``` or ~~~), for SKILL.md prose detectors.
+ * A fenced block is an example being *shown* — a template, a sample header, a command
+ * transcript — not something the skill asserts about itself (cognium-ai#417 / #418).
+ */
+export function fenceMask(lines) {
+    const mask = new Array(lines.length).fill(false);
+    let open = null;
+    for (let i = 0; i < lines.length; i++) {
+        const m = /^\s{0,3}(`{3,}|~{3,})/.exec(lines[i]);
+        if (m) {
+            if (open === null) {
+                open = m[1][0];
+                mask[i] = true;
+                continue;
+            }
+            if (m[1][0] === open) {
+                open = null;
+                mask[i] = true;
+                continue;
+            }
+        }
+        mask[i] = open !== null;
+    }
+    return mask;
+}
+/**
+ * cognium-ai#416 — packaging a project and POSTing it to a deployment service is the
+ * *product*, not exfiltration. `vercel-deploy-claimable`'s `deploy.sh` tars the project
+ * and posts it to `api.vercel.com` with the operator's own token, and fired CRITICAL.
+ *
+ * Two conditions, both required, mirroring the ticket's "declared destinations" ask:
+ *   1. every absolute host the file talks to is a known deploy / publish endpoint, and
+ *   2. the skill DECLARES that intent in its own SKILL.md.
+ *
+ * Requirement 1 alone would let an attacker use a deploy host as a drop; requirement 2
+ * alone would let a "deployment helper" ship the tree anywhere. An archive posted to a
+ * deploy endpoint *plus* any other host still fires — that is the exfiltration shape.
+ */
+const DEPLOY_ENDPOINT_HOST = /\b(?:api\.vercel\.com|vercel\.app|api\.netlify\.com|netlify\.app|uploads?\.github\.com|registry\.npmjs\.org|upload\.pypi\.org|api\.cloudflare\.com|pages\.dev|api\.heroku\.com|api\.fly\.io|api\.render\.com|backboard\.railway\.app|api\.digitalocean\.com|surge\.sh|firebaseio\.com|[\w.-]*\.firebaseapp\.com|storage\.googleapis\.com|[\w.-]*\.blob\.core\.windows\.net|s3[.-][\w-]*\.amazonaws\.com)\b/i;
+const DEPLOY_INTENT = /\b(?:deploy(?:s|ing|ment)?|publish(?:es|ing)?|release(?:s|ing)?|upload(?:s|ing)?\s+(?:the\s+)?(?:site|project|build|bundle|artifact))\b/i;
+export function isDeclaredDeployUpload(content, skillMd) {
+    if (!skillMd || !DEPLOY_INTENT.test(skillMd))
+        return false;
+    const hosts = [...content.matchAll(/https?:\/\/([A-Za-z0-9._-]+)/g)].map((m) => m[1]);
+    if (hosts.length === 0)
+        return false;
+    return hosts.every((h) => DEPLOY_ENDPOINT_HOST.test(h));
+}
 // ---------------------------------------------------------------------------
 // SR-D2 #24 — always-on / auto-attach sprawl
 // ---------------------------------------------------------------------------
@@ -1479,7 +1731,10 @@ function scanMultimodalDeference(skillMd) {
 // opt-in helper ("only run when invoked; never auto-attach") stays clean — so the
 // detector needs the affirmative claim AND the absence of an explicit negation
 // (the safe twin literally contains the word "auto-attach", but negated).
-const ALWAYS_ON_AFFIRMATIVE = /\bfor all tasks\b|\binvoked first\b|\bbefore any other skill\b|\b(?:use this skill |run |activate |attach )?automatically (?:for|on|in|to) (?:every|all|each|any)\b|\bauto-?attach(?:es|ing)?\s+to\s+(?:all|every|any)\b|\bwithout waiting for the user to invoke\b|\b(?:runs?|loads?|activates?|attach(?:es)?|applies|applied|inject(?:s|ed)|active|enabled|invoked|fires?)\b[^.\n]{0,30}\bin every (?:session|conversation)\b|\bin every (?:session|conversation)\b[^.\n]{0,40}\b(?:without|regardless)\b|\balways[- ]?on\b(?=[^.\n]{0,40}\b(?:skill|plugin|helper|agent|hook|assistant|rule|instruction)s?\b)|\b(?:skill|plugin|helper|agent|hook|assistant)s?\b[^.\n]{0,40}\balways[- ]?on\b|\b(?:for|to) every repository\b|\bprefer this skill over (?:project|local|user)\b/i;
+const ALWAYS_ON_AFFIRMATIVE = /\b(?:this skill|use|used|uses|run|runs|apply|applies|applied|activate|activates|attach(?:es)?|invoke[ds]?|enabled?)\b[^.\n]{0,40}\bfor all tasks\b|\binvoked first\b|\bbefore any other skill\b|\b(?:use this skill |run |activate |attach )?automatically (?:for|on|in|to) (?:every|all|each|any)\b|\bauto-?attach(?:es|ing)?\s+to\s+(?:all|every|any)\b|\bwithout waiting for the user to invoke\b|\b(?:runs?|loads?|activates?|attach(?:es)?|applies|applied|inject(?:s|ed)|active|enabled|invoked|fires?)\b[^.\n]{0,30}\bin every (?:session|conversation)\b|\bin every (?:session|conversation)\b[^.\n]{0,40}\b(?:without|regardless)\b|\balways[- ]?on\b(?=[^.\n]{0,40}\b(?:skill|plugin|helper|agent|hook|assistant|rule|instruction)s?\b)|\b(?:skill|plugin|helper|agent|hook|assistant)s?\b[^.\n]{0,40}\balways[- ]?on\b|\b(?:for|to) every repository\b|\bprefer this skill over (?:project|local|user)\b/i;
+// cognium-ai#417: `for all tasks` had no subject requirement, so the documentation
+// checkbox `- [ ] [Create todos for all tasks]` read as an auto-attach claim. It now
+// needs a skill-activation verb within 40 chars, matching the #352-pass-2 subject rule.
 // #352 pass 2: "always-on" / "in every session" needed the SKILL as subject. 7/7 sampled
 // rows (skillsregistry#93) were prose about an always-on *process / endpoint / HTTPS
 // service* or a CLI "available in every session" — infrastructure, not auto-attach.
@@ -1501,7 +1756,13 @@ function scanTriggerHijack(skillMd) {
     if (!alwaysOnClaim(skillMd))
         return [];
     const lines = skillMd.split(/\r?\n/);
-    const line = firstLineMatching(lines, ALWAYS_ON_AFFIRMATIVE);
+    // cognium-ai#417: the claim has to be prose the skill asserts about itself. A fenced
+    // block or a `- [ ]` task-list item is an example being shown, not a declaration.
+    const fenced = fenceMask(lines);
+    const claimLines = lines.map((l, i) => (fenced[i] || /^\s*[-*]\s*\[[ xX]?\]/.test(l) ? '' : l));
+    if (!alwaysOnClaim(claimLines.join('\n')))
+        return [];
+    const line = firstLineMatching(claimLines, ALWAYS_ON_AFFIRMATIVE);
     const meta = META.trigger_hijack;
     return [
         {
@@ -1916,22 +2177,53 @@ export function scanBrokenReferences(bundle) {
                 inlineRefs.push(raw);
         }
     }
+    // cognium-ai#418 — a link inside a fenced block is a TEMPLATE being shown, not an asset
+    // the skill ships: CowAgent's `[Related Page](../category/related-page.md)` sits in a
+    // page-template code block. Reference positions inside a fence are dropped.
+    const fenced = fenceMask(lines);
+    const lineOfOffset = (() => {
+        const starts = [];
+        let acc = 0;
+        for (const l of lines) {
+            starts.push(acc);
+            acc += l.length + 1;
+        }
+        return (off) => { let lo = 0, hi = starts.length - 1; while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (starts[mid] <= off)
+                lo = mid;
+            else
+                hi = mid - 1;
+        } return lo; };
+    })();
+    // cognium-ai#420 — a reference that ESCAPES the bundle root is provable from the string
+    // alone: `../using-superpowers/references/` is outside the bundle whether or not it
+    // exists on disk. The extension test and the `rootPath` requirement were both hiding
+    // this class, so obra/executing-plans returned 0 findings for a plain sibling escape.
+    const escapingRefs = [];
+    for (const em of md.matchAll(/`(\.\.\/[A-Za-z0-9_./-]+)`/g))
+        escapingRefs.push({ raw: em[1], off: em.index ?? 0 });
     const refIter = [];
     while ((m = linkRe.exec(md)) !== null)
-        refIter.push({ raw: m[1].trim() });
+        refIter.push({ raw: m[1].trim(), off: m.index });
     for (const raw of inlineRefs)
-        refIter.push({ raw });
-    for (const { raw } of refIter) {
+        refIter.push({ raw, off: md.indexOf('`' + raw + '`') });
+    for (const e of escapingRefs)
+        refIter.push(e);
+    for (const { raw, off } of refIter) {
         // Skip URL schemes, anchors, protocol-relative, mailto/tel.
         if (/^[a-z][a-z0-9+.-]*:/i.test(raw) || raw.startsWith('#') || raw.startsWith('//'))
             continue;
+        if (off >= 0 && fenced[lineOfOffset(off)])
+            continue; // #418: an example, not an asset
         const ref = norm(raw);
         if (!ref || seen.has(ref))
             continue;
+        const escapes = ref.includes('../');
         // Only flag things that look like a file (have an extension) — avoids prose refs.
-        if (!/\.[a-z0-9]{1,8}$/i.test(ref))
+        // An escaping path is exempt: the escape itself is the finding (#420).
+        if (!escapes && !/\.[a-z0-9]{1,8}$/i.test(ref))
             continue;
-        const escapes = ref.includes('../');
         // Present if an exact path, or a bundle file ends with this ref (basename/suffix match).
         const found = present.has(ref) ||
             bundleFiles.some((p) => norm(p) === ref || norm(p).endsWith('/' + ref) || norm(p).endsWith(ref.replace(/^.*\//, ''))) ||
@@ -1945,7 +2237,9 @@ export function scanBrokenReferences(bundle) {
             severity: 'low',
             artifact: 'SKILL.md',
             title: META.broken_reference.title,
-            description: `SKILL.md links "${raw}" which is not present in the bundle${escapes ? ' (path escapes the bundle root)' : ''}; it would be resolved from an external location at runtime.`,
+            description: escapes
+                ? `SKILL.md references "${raw}", a path outside the bundle root; it would be resolved from an external location at runtime.`
+                : `SKILL.md links "${raw}" which is not present in the bundle; it would be resolved from an external location at runtime.`,
             evidence: { detector: 'broken_reference', reference: raw, escapesRoot: escapes },
             confidence: 0.7,
             cwe: META.broken_reference.cwe,