scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-09-12 23:01:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(skills): check high-risk patterns before HTTP methods in safe-mode crawling

Browse source 
Resolves Greptile PR review feedback pointing out that checking
GET/HEAD/OPTIONS first could authorize destructive actions mapped
to read-only methods. The decision framework now checks high-risk
URL patterns first, regardless of HTTP method.
This commit is contained in:
sandiyochristan 2026-08-06 22:03:08 +05:30
parent 057d7b5246
commit 8e99c63b23
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
strix/skills/custom/safe_mode_crawling.md
View file

@ -69,11 +69,11 @@ Before submitting any form, check:
## Decision Framework
```
Is this action read-only (GET/HEAD/OPTIONS)?
├── YES → Proceed
└── NO → Does the endpoint match a high-risk pattern?
├── YES → STOP. Log the finding. Do NOT execute.
│ Surface to operator with: URL, method, parameters, and risk assessment.
Does the endpoint match a high-risk pattern (e.g., /delete, /payment)?
├── YES → STOP. Log the finding. Do NOT execute.
│ Surface to operator with: URL, method, parameters, and risk assessment.
└── NO → Is this action strictly read-only (GET/HEAD/OPTIONS)?
├── YES → Proceed
└── NO → Is this a standard form submission / API call for testing?
├── YES → Check: can this action be reversed?
│ ├── YES (e.g., create a test user that can be deleted) → Proceed with caution