From 8e99c63b23b4916d2bff28b4ea299cb54bf3568e Mon Sep 17 00:00:00 2001 From: sandiyochristan Date: Thu, 6 Aug 2026 22:03:08 +0530 Subject: [PATCH] fix(skills): check high-risk patterns before HTTP methods in safe-mode crawling Resolves Greptile PR review feedback pointing out that checking GET/HEAD/OPTIONS first could authorize destructive actions mapped to read-only methods. The decision framework now checks high-risk URL patterns first, regardless of HTTP method. --- strix/skills/custom/safe_mode_crawling.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/strix/skills/custom/safe_mode_crawling.md b/strix/skills/custom/safe_mode_crawling.md index 3282c30b..e216ad42 100644 --- a/strix/skills/custom/safe_mode_crawling.md +++ b/strix/skills/custom/safe_mode_crawling.md @@ -69,11 +69,11 @@ Before submitting any form, check: ## Decision Framework ``` -Is this action read-only (GET/HEAD/OPTIONS)? -├── YES → Proceed -└── NO → Does the endpoint match a high-risk pattern? - ├── YES → STOP. Log the finding. Do NOT execute. - │ Surface to operator with: URL, method, parameters, and risk assessment. +Does the endpoint match a high-risk pattern (e.g., /delete, /payment)? +├── YES → STOP. Log the finding. Do NOT execute. +│ Surface to operator with: URL, method, parameters, and risk assessment. +└── NO → Is this action strictly read-only (GET/HEAD/OPTIONS)? + ├── YES → Proceed └── NO → Is this a standard form submission / API call for testing? ├── YES → Check: can this action be reversed? │ ├── YES (e.g., create a test user that can be deleted) → Proceed with caution