Harden GitHub bounty cron scouting - #24480
Conversation
|
Update: adjusted the bounty cron wording so that after explicit TAKE confirmation, the authorized follow-up workflow includes claim/reservation when rules allow it, creating a working branch, making the minimal patch, committing, pushing, and opening the PR/submission. The hard safety boundary remains: no unauthorized scanning, no platform-rule bypassing, no spam, no fabricated findings, and no public disclosure of private vulnerabilities. |
alt-glitch
added
type/feature
|
Update: added a read-only manual bounty watchlist for Kyo gRPC #390, ISAAC-497 Enhanced RAG Pipeline, and Twenty IMAP. The no-agent cron report now includes a Manual Watchlist section with repo/link, amount, status, required skills, difficulty, competition risk, existing PR signals, recommended action, reason, and next safe read-only command. Also tightened PR detection to avoid treating plain issue references as PRs. The current guardrail is read-only: no claim, branch, code change, commit, push, or PR from unattended runs; unauthorized scanning remains prohibited. |
|
Update: wired https://algora.io/bounties into the no-agent bounty cron as a public HTML read-only source. Each run now includes a Public Bounty Sources section with extracted highlights from Algora's public listing, currently Twenty (YC S23) ,500 IMAP, Kyo #390 gRPC Support, and Isaac #45 [ISAAC-497]. The source config explicitly avoids deep-link dependence, stealth browser flows, CAPTCHA workarounds, and proxies. |
ixhxpns
changed the title
teknium1
left a comment
teknium1
left a comment
There was a problem hiding this comment.
Thanks for the safety-oriented scouting and TAKE-gating work. The current implementation needs a substantial re-scope before it can be salvaged.
Problems
.hermes/is explicitly runtime state, not a code artifact (.gitignore:111-114; commite2a92ce64). Meanwhile cron resolves scripts only from activeHERMES_HOME/scripts(cron/scheduler.py:2044-2065), so the PR's repo-root.hermesjob and script lack a supported installation path.- The script restores
GITHUB_TOKEN/GH_TOKENfrom.env(.hermes/scripts/github_bounty_income_30m.py:54-67) after the cron subprocess sanitizer deliberately strips those credentials (tools/environments/local.py:391-404). - The pipeline deadline is not applied to post-scout source/watchlist calls (
github_bounty_income_30m.py:772,792-793), which retain independent 25/30-second operations (:176-184,:234-244). - Both new skill descriptions exceed the 60-character hard limit in
AGENTS.md:888-900; the second skill has no matching skill test (AGENTS.md:948-950).
Suggested changes
- Rework this around a supported profile-aware install/config surface; do not commit user runtime state.
- Preserve credential sanitization, enforce one end-to-end deadline, and add focused tests for the script and both skills.
Automated hermes-sweeper review.
| "deliver": "local", | ||
| "origin": null, | ||
| "enabled_toolsets": [], | ||
| "workdir": "/Users/jason/gittools/HermesAgent", |
There was a problem hiding this comment.
This hardcodes the contributor's macOS checkout. More fundamentally, current cron resolves script under the active profile's HERMES_HOME/scripts (cron/scheduler.py:2044-2065), while .hermes/ is explicitly ignored runtime state. Please replace this checked-in runtime job with a supported profile-aware installation/configuration path.
| line = line[len("export ") :].strip() | ||
| key, value = line.split("=", 1) | ||
| key = key.strip() | ||
| if key in {"GITHUB_TOKEN", "GH_TOKEN"} and key not in os.environ: |
There was a problem hiding this comment.
Cron intentionally sanitizes child environments and unconditionally strips GH_TOKEN and GITHUB_TOKEN (tools/environments/local.py:391-404). Reloading them here bypasses that security boundary before spawning gh; use an explicitly supported credential path instead.
| ranked = sorted(enriched, key=lambda c: c.score, reverse=True) | ||
| take = next((candidate for candidate in ranked if candidate.gate == "TAKE"), None) | ||
| cloned = maybe_clone(take) | ||
| source_results = inspect_sources() |
There was a problem hiding this comment.
The deadline is only checked during scouting/enrichment. These source and watchlist calls run after that budget and can each spend independent HTTP/subprocess timeouts, so BOUNTY_SCOUT_PIPELINE_TIMEOUT_SECONDS is not an end-to-end bound. Pass remaining time into these calls or skip them when the deadline has elapsed.
| @@ -0,0 +1,287 @@ | |||
| --- | |||
| name: bounty-target-execution | |||
| description: "Use when evaluating or executing an authorized bounty target from Algora, GitHub issues, or similar platforms, requiring target verification, TAKE gating, read-only scouting, explicit confirmation before external actions, command planning, and communication drafts." | |||
There was a problem hiding this comment.
New skills must have a one-sentence description of at most 60 characters ending in a period (AGENTS.md:888-900). Please shorten this description; the same rule also applies to github-bounty-workflow.
teknium1
added
sweeper:risk-security-boundary
3 participants
Summary
bounty-target-executionskill for safe Algora/GitHub bounty verification, TAKE gating, DevOps command planning, and communication draftsgithub-bounty-income-30mas read-only scout/scorer andgithub-bounty-execution-teamas manually confirmed execution team with per-action external confirmationVerification
Runtime notes