agent-glovebox: Skill for Claude Code

Vulnerability research

The load-bearing rule

A finding you cannot reproduce is not a finding. It is a hypothesis, and it stays one until a command you can name turns it into evidence. Report the hypothesis as a hypothesis or drop it — never as a vulnerability.

This is the rule the whole activity hangs off, because the economics run against you. Generating a plausible vulnerability narrative is cheap and verifying one is expensive, so an unverified report moves your cost onto whoever reads it. The curl project watched its confirmed-vulnerability rate fall from over 15% to under 5% as unverified AI reports arrived, and closed a seven-year bug bounty on 31 January 2026 rather than keep paying that tax. The recovery is the instructive half: by April 2026 the slop had stopped and the AI-assisted reports that replaced it were mostly valid, because reporters started verifying before sending.

Scope this skill holds

This skill fires when the deliverable is a claim about real software being exploitable. That is a different job from the reviews this tree already has, so pick the right one and do not run two:

• A pending diff before a PR → peer-review.
• A single-pass look at the current branch → the built-in security-review.
• A whole-codebase multi-axis audit ending in a fix plan → parallel-audit.
• Proving an isolation layer still engages, with tests → stress-test.
• A vulnerability claim you intend to act on or send somewhere → this skill.

Deliver the finding set you were asked for. Do not widen a bounded question ("is this one path exploitable?") into a full audit.

Hunting with /goal

Use /goal for an open-ended hunt on one named surface. A bounded question gets no goal. In Codex, set the goal only when the user asks for one. After each turn a small model judges the condition from the transcript alone. So write the condition as the evidence the judge must SEE, never as "a vulnerability was found".

• State the outcome, not the method. Ask for exactly one finding that breaks a quoted claim of the target's threat model (this tree's is SECURITY.md), at evidence level 1 of §2. Name a method only when you want that method ("use Hypothesis").
• List what does not count: SECURITY.md's out-of-scope list and § Known limitations, a finding a §3 tool already reports, evidence below level 1, and any edit to an existing test, hook, lint, deny rule or allowlist entry.
• Make "nothing yet" not met, except at the cap. The judge reads only the condition, so the cap is a second met-clause: the transcript shows the turn count and §7's clean-run report.
• Run an unattended goal inside a glovebox, never on the host.
• Aim at what is ASSUMED, not at what is proved. TLC already checks the invariants under docs/tla/. Hunt in the constants a config hand-sets to stand for shipped code, in a clause a model assumes (Consent.tla's MintedLabels = FALSE), and in the unchecked A- rows of docs/merge-queue-fsm.md §7.