Follow-up to #94 — Layer 4 + docs.
- Bot-token blast radius: document + verify the bot token is a fine-grained PAT scoped to this single repo, so a compromised agent can't read/write sibling repos. Add the check to the setup skill's bot-verification step.
- HARDENING.md prompt-injection section (module
docs): describe the layered defenses (fencing/sanitizer, protected-paths guard, threat scan, token scoping) and their limits — LLM gates are probabilistic; deterministic layers + token scoping carry the weight. Note the known v1 gaps of the sanitizer primitive (e.g. homoglyph LETTER substitution / full NFKC-confusables of the fence marker are out of scope for the deterministic layer, backstopped by the secret nonce).
Acceptance (from #94): "HARDENING.md gains a 'prompt injection' section describing the layers and their limits."
Follow-up to #94 — Layer 4 + docs.
docs): describe the layered defenses (fencing/sanitizer, protected-paths guard, threat scan, token scoping) and their limits — LLM gates are probabilistic; deterministic layers + token scoping carry the weight. Note the known v1 gaps of the sanitizer primitive (e.g. homoglyph LETTER substitution / full NFKC-confusables of the fence marker are out of scope for the deterministic layer, backstopped by the secret nonce).Acceptance (from #94): "HARDENING.md gains a 'prompt injection' section describing the layers and their limits."