fix(claude-config): add disallowed-tools to audit-pass report-only contract

[kyle-sexton]

Adds disallowed-tools to audit-pass frontmatter so the report-only contract is enforced mechanically like the sibling audit skills.

Fixes #2415

Summary

Adds disallowed-tools to audit-pass frontmatter so the report-only contract is enforced mechanically like the sibling audit skills.

Related

N/A

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 2m 35s —— View job

---

Security Review

• Fetch PR diff and gather context
• Read changed file(s)
• Analyze for security issues (logic flaws, access control, injection, secrets, dangerous Actions patterns)
• Post findings

This PR adds a single line to plugins/claude-config/skills/audit-pass/SKILL.md frontmatter — a Claude Code skill definition (agent instructions), not application code or a GitHub Actions workflow. No workflow files, secrets handling, or injection-relevant code paths are touched, so most of the usual categories (SQL/command/path injection, credential handling, pull_request_target/permissions changes) don't apply here. zizmor's lane is also not implicated (no CI/workflow changes).

One finding worth flagging on the logic/trust-boundary front:

---

IMPORTANT — disallowed-tools: Edit, NotebookEdit only closes 2 of the mutation vectors the skill body promises are closed

Line 6

The skill's own prose makes strong guarantees: "Bare invocation reads and reports" (L23) and "Never edits managed policy or a user-scope file, in any mode" (L429). The PR's stated goal is to make that "report-only contract... enforced mechanically" rather than by prose alone — which matches this marketplace's own stated doctrine that "a mechanism outranks instruction text" (audit-instructions/reference/criteria.md L751).

But Edit and NotebookEdit are not the tools that matter for that guarantee. Bash and Write remain fully unrestricted by this frontmatter, and both are legitimately used elsewhere in this same skill (Bash for git/state operations in Phase 0, Write for the findings.json/findings.partial report artifacts in Phase 6). Either one can write to any path — including managed policy or user-scope files the skill promises never to touch — via Write directly or shell redirection (echo ... > path, sed -i, cp) through Bash. Nothing in the added frontmatter, or elsewhere in the diff, scopes those two tools the way plugins/repo-hygiene/skills/clean/SKILL.md does for a comparable mutation contract (narrow Bash(...) allowlist entries plus a PreToolUse destructive-action guard).

This matters beyond "the prose could technically be violated": audit-pass explicitly ingests three scopes of instruction content, including project-scope files from the audited repo, as part of its normal operation (Phase 1). If any of that read content is adversarial (a poisoned CLAUDE.md, skill body, or hook), a prompt-injection payload could direct the agent to use the still-available Bash/Write tools to write outside the report path — e.g., into managed/user scope — with no tool-level backstop, even though the skill's contract explicitly says that must never happen "in any mode."

The one-line change is not itself harmful (it only removes capability), and it's consistent with — not worse than — the sibling audit skills, none of which currently set disallowed-tools either (audit-instructions, audit-permission-grants, audit-permission-state all lack it despite similar "report-only" language in their own descriptions). But the PR title/description claim the report-only contract is now "enforced mechanically," and as written, the two most powerful mutation vectors are untouched — so the mechanical guarantee is materially weaker than the claim suggests, which could give false confidence to anyone relying on it as a hard boundary.

Confidence: Medium-high on the technical fact (Bash/Write remain unrestricted and can mutate arbitrary files — verified from the frontmatter and tool usage in the file body). Lower on real-world exploitability, since it requires either a hallucinating/misaligned model action or a successful prompt-injection via audited content rather than a direct attacker-controlled input.

Fix this →

---

No other security-relevant issues found in this diff.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d4393d4f0f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31591414879
• Failure class: other
• Last SDK result: (no execution file was produced)

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job to retry the review; a new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31591414986
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).