Skills trial: cloudflare/security-audit-skill name-only for LLM-native automation; stale-upstream flags; sandbox-profile open gate

[seathatflowsinourveins]

Scope

• Adds cloudflare/security-audit-skill as a trial skill, pinned at c1c8a8c. Its Claude listing is name-only so that LLM-native automation (workflow stages) can call it. The user rejected user invocation, so it is not user-invocable-only. name-only still leaves /security-audit in the / menu and invocable by Claude, so stage-only use is a usage policy, not an enforced setting. No agent preloads it, and Codex is disabled for the trial.
• Flags two stale upstreams:
  • openai/skills: no commits on main since 2026-06-24.
  • praetorian-inc/noseyparker: archived 2026-04-24.
• Opens the foundation gate claude-code-sandbox-profile. It is deferred to a later wave, but tracked.
• Base commit: ba1700ad; main merged in at f508ffba per the docs/lanes.md hot-file protocol.
• Lane: lane:foundation.
• Owned paths:
  • adoption/skills/manifest.json
  • adoption/templates/claude.settings.template.json (the skillOverrides mirror)
  • adoption/manifest.json (continuation.next_action_refs)
  • catalogs/foundation/manifest.json
  • docs/decisions/2026-09-25-skills-trial-and-usage.md (2026-09-27 addendum)
  • evidence/artifacts/cloudflare-audit-skill-trial-20260927/
  • manifests/evidence.json (hot-file registration)

catalogs/foundation/manifest.json requires exactly three ranked top gaps, so the new open gap takes priority slot 2 from worker-cancellation-crash-resume (accepted_within_scope). That gap's content stays in decision native-child-interruption-recovery: its evidence_scope sentence is verbatim, and its limitations and next_gap carry the retained caveats and the reuse rule.

Nothing is installed by this PR. Once it is merged, the coordinator installs the skill following the receipt README: settings template, then the Codex disable table, then install_skills.py --only security-audit, then a read-back.

SOTA sources

• https://github.com/cloudflare/security-audit-skill @ c1c8a8c1471069fb0e188eeaff69b8e8db6564a8, skills/security-audit/ (tree ccbc33e, SKILL.md sha256 5e3e96a1…), MIT. Issue Separate native foundation and trading catalogs with upstream acceptance #20 is cited as weak third-party evidence.
• The skills.sh listing and its audits (read 2026-09-27): Gen Agent Trust Hub Pass, Socket Pass, Snyk Warn W011. Under the 2026-09-25 gate, a Warn does not exclude.
• Claude Code docs (code.claude.com/docs/en/{commands,skills,settings-reference,sandboxing}): name-only semantics, /security-review and /code-review scope, and the sandbox settings. Quoted lines and page hashes are in delta.json.
• https://blog.cloudflare.com/build-your-own-vulnerability-harness/ (the method reference).
• Peer practice sweep KC-28 and KC-11 (native-agent-stack-a9, 2026-09-27): the sandbox gate's strictAllowlist and credentials arms, and claude plugin eval --ablation with-without as a bake-off harness candidate.

Evidence-class table

Claim	Evidence class	Command / receipt
Pin, tree and SKILL.md hashes at c1c8a8c	source_review	gh api calls recorded in evidence/artifacts/cloudflare-audit-skill-trial-20260927/delta.json
Audit verdicts (Gen Pass, Socket Pass, Snyk Warn W011)	source_review	skills.sh pages fetched 2026-09-27 (hashes in delta.json)
Manifest and template consistency	local_integration	tests.test_skills_manifest 21 OK (control: fails without the template key), test_install_skills 19 OK, test_skills_status 43 OK
Open gate matches its unfinished gap	local_integration	scripts/validate_foundation.py passes; 2 broken throwaway variants fail with "must reference exactly the unfinished gaps"
Skill installed and discovered by the client	not yet: post-merge	coordinator install and read-back after merge

Local commands run

$ python3 -m unittest tests.test_skills_manifest tests.test_install_skills tests.test_skills_status
Ran 83 tests ... OK
$ python3 scripts/validate_foundation.py && python3 scripts/validate_catalogs.py
FOUNDATION catalog valid (layers 20, decisions 54); catalog structure validated
$ python3 scripts/validate.py
{status passed}

The whole-suite run fails locally because of the host's empty /tmp/.git (a known gotcha that trips tests' "outside every repository" guards). CI is the full gate.

Decision record

docs/decisions/2026-09-25-skills-trial-and-usage.md, 2026-09-27 addendum. It covers:

• the gate results;
• the refutation of the 2026-09-23 not_adopted proposal, with the gap restated: native reviews are diff-scoped, and we have no whole-repository audit with a coverage ledger and a three-verdict contract;
• the M5b suitability gate;
• the M5c bake-off, queued behind Gates A and B with a high budget per the user;
• the trial exit and the overturn condition.

Review

• Claude evidence-reviewer: one round, 3 major and 2 minor findings, all applied in repair commit 90a5c0e3.
• Cross-family GPT-6 review (codex exec -s read-only -m gpt-6-astra, effort max, on 90a5c0e3, 2026-09-28): changes-needed. One P2: name-only hides only the description. Claude can still invoke the skill by name, and it stays in the / menu, so "no user trigger" and "cannot fire" overclaimed.
• Repair round:
  • 8fce09c5 restates the wiring as a usage policy.
  • A Claude stack-verifier re-ran the probes. P2 was fixed, but it found a new claim of the same kind: that user-invocable: false would enforce stage-only use.
  • b3db21da limits the residual to the user trigger. Skills docs L799: "With user-invocable: false, you can't invoke the skill, but Claude still can." L796: disable-model-invocation: true removes the skill from Claude's context entirely.
• Residuals:
  • Stage-only use is a usage policy that no setting enforces.
  • Removing the user trigger needs a new upstream pin plus a native probe.
  • Invocation reach is live-run-pending.

Checklist

• No new or changed Actions.
• No secrets printed, logged or committed. A gitleaks false positive on a public tree SHA key was fixed by renaming the key, with no allowlist and no --no-verify.
• No paid hosting.
• Peer-owned files and worktrees preserved.

🤖 Generated with Claude Code