rhwp-provenance
rhwp-provenance is a Secrets & supply chain skill for AI agents, published by edwardkim in the rhwp repository on GitHub. Skillspace rates rhwp-provenance F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.
Risky. This skill has patterns associated with unsafe behaviour. Read the source carefully before running it.
rhwp 봉투의 출처 표지(untrustedContent/untrustedFields)를 읽고 문서 파생 값을 데이터로 격리하는 규약입니다. export-provenance-map 으로 "어느 필드가 문서에서 온 값인가" 지도를 얻고, 문서 파생 값을 프롬프트에 넣을 때의 주입 방어 수칙(inspect injection 연계, nonce 경계 표지, 금지 자리 목록)을 적용합니다. 트리거 — 사용자가 "이 값이 문서에서 온 건가", "untrustedFields/출처 표지", "export-provenance-map", "프롬프트 주입 방어", "신뢰할 수 없는/출처 모르는 문서 처리", "문서 텍스트를 LLM에 넣어도 되나", "inspect injection" 등을 요청할 때. 계약 전문은 mydocs/tech/envelope_provenance.md. 에이전트 소비 절차는 references/ 와 fixtures/.
- Grade
- F
- Quality
- 45 / 100
- Safety
- Risky
- GitHub stars
- 3,807
Unproven: rated by static analysis only, not yet compared head-to-head.
Our two independent classifiers differ on this skill's category, so treat the placement as provisional.
This rating describes the version of the repository we crawled; it may have changed since.
Our review
- Architecture
- 88 / 100
- Maturity
- Structured: ships references or scripts
- Security scan
- High-risk patterns
- License
- Not declared. Check the repository before reusing it.
What the scanner flagged
- exfiltration language
Not checked yet
- Category is a classifier prediction; no model has read this skill yet
- Not judged on the rubric yet (not a contender in its category)
- No blind task eval yet
- Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
- Sibling files (scripts, references) not fetched; security scan covers SKILL.md only
Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.