{"format": "ta-amps.seed-pack.nouns.v1", "pack_id": "agent-config-supply-chain-scanner", "status": "proposal_only", "records": [
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.pack", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-config-supply-chain-scanner", "role:pack", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "pack", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "A collection of nouns and verbs for defending coding harnesses against repository config supply-chain attacks", "lets_workers": "Inventory agent, rule, MCP, and persona memory files before repository use, detect Rules File Backdoor Unicode smuggling, block unapproved hooks and MCP servers, catch built-in subagent shadowing and authority spoofing, and gate self-editing memory diffs.", "not_for": "Executing untrusted hooks or mutating repository dotfiles automatically.", "flow": [{"verb": "agent-config-supply-chain-scanner.scan-repo-agent-configs", "when": "First: scan all discovered agent, rule, and MCP files in the checkout."}, {"verb": "agent-config-supply-chain-scanner.gate-self-editing-memory-diff", "when": "Before persisting any self-edited SOUL.md or memory update."}, {"verb": "agent-config-supply-chain-scanner.quarantine-supply-chain-finding", "when": "When a scan or memory diff returns block, record a failure tombstone."}], "guardrails": [{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "version": 1, "value_sha256": "19544b1ffaef2cfa03e2a6c63e767357c27591d09cd1f71950fc669fa0f3cf13"}, {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.diff-gate-evolving-memory", "version": 1, "value_sha256": "58219b45f463fd30943a5db65a03efc744f131b6f162f27b5a76a1481e1700d2"}], "tool": {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "version": 1, "value_sha256": "e459e6e0debb5138089291e1bf390b6cc1777b5f91439b62e8b0ff880d91811c"}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.method", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.guardrail.diff-gate-evolving-memory", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "target_category": "noun.reflex_procedure", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "target_category": "noun.code_node", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.template.config-scan-report", "target_category": "noun.eval_run", "note": ""}]}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.method", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-config-supply-chain-scanner", "role:method", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "method", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Method: inventory inert bytes, scan five threat vectors, and quarantine blocks", "category_reason": "Shared defensive inspection pipeline for untrusted repo configs and evolving memory.", "lifecycle": ["scan-repo-agent-configs hashes every harness config file and checks all five supply-chain vectors.", "gate-self-editing-memory-diff inspects unified diff additions on SOUL.md or memory files before write persistence.", "quarantine-supply-chain-finding records a negative tombstone citing exact file paths and vectors."], "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-config-supply-chain-scanner", "role:guardrail", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "guardrail", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Guardrail: scan .claude, .codex, .cursor, .github/agents, .kiro, .opencode, and MCP files as untrusted code", "rule": "Never open or trust a repository's agent or MCP configs in an interactive harness before config_scanner confirms verdict == 'clean'.", "how_it_is_checked": "scan_repository_configs sets verdict='block' on any critical or high finding.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.diff-gate-evolving-memory", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.skill_pack", "pack:agent-config-supply-chain-scanner", "role:guardrail", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.skill_pack", "role": "guardrail", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Guardrail: block unreviewed persistence of poisoned self-editing persona memory", "rule": "Self-edited memory additions containing hidden Unicode, authority overrides, shell pipes, or new external URLs set approved_for_auto_persist=false.", "how_it_is_checked": "diff_self_editing_memory inspects added lines deterministically.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.reflex_procedure", "pack:agent-config-supply-chain-scanner", "role:rules", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.reflex_procedure", "role": "rules", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Deterministic detection signatures across five agent-config supply-chain vectors", "unicode_smuggling": "Bidi controls (U+202A..U+202E, U+2066..U+2069, U+061C), Unicode Tags (U+E0000..U+E007F with ASCII decode), and mid-file zero-width codepoints.", "hook_and_mcp_escalation": "bypassPermissions/autoApprove flags, PreToolUse/PostToolUse/SessionStart hooks, shell-pipe MCP commands, and unpinned npx -y installs.", "shadowing_and_spoofing": "Reserved slugs (explore, plan, general-purpose, bash, default, self, research, main) and CEO/CISO/override authority claims.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.config-scan-report", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:agent-config-supply-chain-scanner", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Template: repository agent-config supply-chain scan report", "describes": "scanned config count, inventory SHA-256, verdict, and vector findings", "schema": {"type": "object", "additionalProperties": false, "required": ["scanned_files_count", "inventory_sha256", "verdict", "findings"], "properties": {"scanned_files_count": {"type": "integer", "minimum": 0}, "inventory_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}, "verdict": {"type": "string", "enum": ["clean", "review", "block"]}, "findings": {"type": "array", "maxItems": 500, "items": {"type": "object", "additionalProperties": false, "required": ["vector", "severity", "path"], "properties": {"vector": {"type": "string", "minLength": 2, "maxLength": 80}, "severity": {"type": "string", "enum": ["critical", "high", "medium"]}, "path": {"type": "string", "minLength": 1, "maxLength": 260}}}}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.memory-diff-receipt", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:agent-config-supply-chain-scanner", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "template", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Template: self-editing persona memory diff gate receipt", "describes": "before/after SHA-256 digests, added line count, and auto-persist approval flag", "schema": {"type": "object", "additionalProperties": false, "required": ["file_label", "before_sha256", "after_sha256", "added_line_count", "approved_for_auto_persist"], "properties": {"file_label": {"type": "string", "minLength": 1, "maxLength": 120}, "before_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}, "after_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}, "added_line_count": {"type": "integer", "minimum": 0}, "approved_for_auto_persist": {"type": "boolean"}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.supply-chain-tombstone", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.negative_tombstone", "pack:agent-config-supply-chain-scanner", "role:template", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.negative_tombstone", "role": "template", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Template: quarantined supply-chain config tombstone", "describes": "a blocked repository config or poisoned memory update recorded as a tombstone", "schema": {"type": "object", "additionalProperties": false, "required": ["tombstone_id", "inventory_sha256", "blocked_vectors", "remediation_rule"], "properties": {"tombstone_id": {"type": "string", "minLength": 4, "maxLength": 40}, "inventory_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}, "blocked_vectors": {"type": "array", "minItems": 1, "maxItems": 50, "items": {"type": "string", "minLength": 2, "maxLength": 80}}, "remediation_rule": {"type": "string", "minLength": 5, "maxLength": 400}}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.scanner-checks", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.benchmark_suite", "pack:agent-config-supply-chain-scanner", "role:record_checks", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.benchmark_suite", "role": "record_checks", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Deterministic checks for agent-config supply-chain scan reports", "fixture_kind": "finding_checks", "purpose": "Deterministic checks every agent config supply-chain scan report must satisfy.", "deterministic_checks": [{"id": "inventory-digest-pinned", "rule": {"rule": "pattern_present", "path": "inventory_sha256", "pattern": "^[0-9a-f]{64}$"}, "why": "Every scan report pins the SHA-256 digest of the discovered config file inventory."}, {"id": "verdict-valid", "rule": {"rule": "enum", "path": "verdict", "values": ["clean", "review", "block"]}, "why": "verdict must be clean, review, or block."}, {"id": "block-has-findings", "rule": {"rule": "when", "if": {"path": "verdict", "equals": "block"}, "then": {"rule": "each_has", "path": "findings", "fields": ["vector", "severity", "path"], "min": 1}}, "why": "Blocked scans must list at least one finding with vector, severity, and file path."}, {"id": "hosts-local", "rule": {"rule": "hosts_local_only", "path": "$"}, "why": "Synthetic scan fixtures must reference local paths or .invalid domains only."}], "golden_fixtures": [{"id": "good-blocked-scan", "label": "known_good", "finding": {"scanned_files_count": 2, "inventory_sha256": "99887766554433221100ffeeddccbbaa99887766554433221100ffeeddccbbaa", "verdict": "block", "findings": [{"vector": "unicode_tag_smuggling", "severity": "critical", "path": ".cursor/rules/style.md"}]}}, {"id": "bad-block-without-findings", "label": "known_bad", "finding": {"scanned_files_count": 1, "inventory_sha256": "99887766554433221100ffeeddccbbaa99887766554433221100ffeeddccbbaa", "verdict": "block", "findings": []}}, {"id": "bad-invalid-verdict", "label": "known_bad", "finding": {"scanned_files_count": 1, "inventory_sha256": "99887766554433221100ffeeddccbbaa99887766554433221100ffeeddccbbaa", "verdict": "ignored", "findings": []}}], "expected": {"good-blocked-scan": {"verdict": "pass", "failed_checks": []}, "bad-block-without-findings": {"verdict": "fail", "failed_checks": ["block-has-findings"]}, "bad-invalid-verdict": {"verdict": "fail", "failed_checks": ["verdict-valid"]}}, "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.code_node", "pack:agent-config-supply-chain-scanner", "role:tool_card", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.code_node", "role": "tool_card", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Tool card: config_scanner standard-library CLI and library", "name": "config_scanner", "code": {"path": "packs/agent-config-supply-chain-scanner/code", "files": 6, "sha256": "88e7e736f264cdefac69d6a5b9c6b0a4631b0990fbc1b7c4c34ba98570df5057"}, "runtime": "Python 3.10 or later, standard library only.", "commands": ["python3 -m config_scanner scan REPO_DIR [--allow-mcp-commands CMD1,CMD2]", "python3 -m config_scanner diff-memory BEFORE.md AFTER.md"], "does": ["Detects hidden Unicode Tag/bidi/zero-width injection, unapproved hooks, MCP shell escalation, name shadowing, and authority spoofing.", "Diff-gates self-editing SOUL.md and memory files before persistence."], "does_not": ["Execute discovered hooks or MCP servers, open network sockets, or modify repository files."], "code_license": "MIT", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "verifies", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "target_category": "noun.reflex_procedure", "note": ""}]}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.source.trojan-source", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.public_source", "pack:agent-config-supply-chain-scanner", "role:source", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.public_source", "role": "source", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Boucher & Anderson (arXiv:2111.00169): Trojan Source Invisible Vulnerabilities", "url": "https://arxiv.org/abs/2111.00169", "checked_on": "2026-10-31", "provides": "Bidirectional and invisible Unicode codepoint mechanics behind hidden source and rule-file attacks.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.source.nvd-cve-2025-54135", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.public_source", "pack:agent-config-supply-chain-scanner", "role:source", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.public_source", "role": "source", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "NIST NVD CVE-2025-54135: Unapproved MCP configuration command execution", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54135", "checked_on": "2026-10-31", "provides": "Advisory detailing prompt-injected creation or mutation of harness MCP configuration files.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.source.unicode-tr36", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.public_source", "pack:agent-config-supply-chain-scanner", "role:source", "content:authored", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.public_source", "role": "source", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Unicode Technical Report #36: Unicode Security Considerations", "url": "https://www.unicode.org/reports/tr36/", "checked_on": "2026-10-31", "provides": "Default-ignorable, tag, and non-visual codepoint classifications for security scanners.", "status": "proposal", "admission": "not_admitted", "content_kind": "authored_guidance", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}},
{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.example.blocked-backdoor-scan", "expected_version": 0, "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:noun.eval_run", "pack:agent-config-supply-chain-scanner", "role:example", "synthetic:true", "spdx:MIT", "status:quarantined"], "value": {"category_id": "noun.eval_run", "role": "example", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "title": "Worked example: synthetic blocked scan catching Unicode Tag smuggling and MCP shell pipe", "conforms_to": {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.config-scan-report", "version": 1, "value_sha256": "dd82544ea90b4f3373454c4157208ac48f4fc7e9bb9ca4b3d1fd9448bca7ea08"}, "instance": {"scanned_files_count": 2, "inventory_sha256": "99887766554433221100ffeeddccbbaa99887766554433221100ffeeddccbbaa", "verdict": "block", "findings": [{"vector": "unicode_tag_smuggling", "severity": "critical", "path": ".cursor/rules/style.md"}, {"vector": "mcp_shell_execution", "severity": "critical", "path": ".cursor/mcp.json"}]}, "shows": "A repository checkout blocked before interactive harness load due to hidden Unicode Tag characters and a shell-piped MCP server.", "source": "Synthetic. Written for this pack.", "status": "proposal", "admission": "not_admitted", "content_kind": "synthetic_example", "license": "MIT", "provenance": {"source": "original ta-amps authored proposal", "license": "MIT", "generator": "scripts/build_packs.py", "independently_verified": false}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": []}}
]}