fix(rules): PERM-001 convicted a skill for a flag it was warning about

[Ap6pack]

Two fixes, both found by reading a file instead of trusting a verdict.

The false positive

ai-talent-grader — a Chinese HR resume-grading skill with no permission behaviour at all — was MALICIOUS at risk 100, on MALWAR-PERM-001 as its only rule, LLM-confirmed.

The matching line, from its deployment notes:

扫描 verdict 达到 CAUTION 且为 community source 时会 BLOCKED，需 `--yolo` 绕过或修复

"When the scan verdict hits CAUTION on a community source it gets BLOCKED; you need --yolo to bypass, or fix it."

The author is documenting a registry publishing gate. The rule matched the bare token --yolo and read it as an instruction.

This is the same defect as MULTI-001 reading consent as evasion — a technique discussed is not a technique performed — and I shipped it again one rule later, in the rule I wrote because I had just learned that lesson.

The fix

Bypass-flag matches now require an execution context: inside a fenced code block, or reached from a command name or imperative on the same line without crossing sentence-ending punctuation (full-width stops included, since much of the registry is Chinese). Negation before the flag disarms it, because "Never run with --yolo" is advice and parses identically to an instruction.

Two things went wrong while building it, both caught by running cases rather than reading the regex:

• The first gate broke a real detection: "Run the agent with --dangerously-skip-permissions" stopped firing, because "the agent" is not a command name. The pre-existing test caught it; imperatives now cover it.
• The second suppressed a true positive: the negation guard scanned the whole line, so "Run claude --flag to avoid prompts" was killed by "avoid" in its tail. Negation now only counts before the flag.

Also: the diagnostic was hiding the evidence

--content truncated at 4,000 chars. The matching line fell outside that window, so the visible portion produced zero findings and the verdict looked inexplicable. Full file by default now; MAX_CHARS trims deliberately.

Verification

1718 passed, 16 skipped

22 cases in both directions. Benign corpus unchanged, malicious control still MALICIOUS at 100, and the vendor connector fleet that motivated the rule still reads SUSPICIOUS 52 on its allowlist edit — so the fix costs no real detection.

Consequence for the numbers

MALWAR-PERM-001 currently reports 767 skills widening agent permissions. That figure includes this false-positive class and is stale until a re-scan. Not to be quoted.

Worth noting separately

The same section of that skill is a field guide to getting past a scanner:

The scanner marks any string containing pip install as MEDIUM supply-chain risk — including echo "安装: pip install xxx". Fix: reword it.

A legitimate author, blocked by false positives of exactly the kind fixed this week, documenting how to launder phrasing until a scanner passes it. Reworded-to-publish and reworded-to-evade are indistinguishable downstream.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DNoTXU8k3pfSBzR7aJubqL

---

Generated by Claude Code