feat: standing capability-vulnerability taxonomy check- #231 by chaksaray · Pull Request #238 · aveproject/ave

chaksaray · 2026-08-30T00:42:56Z

No description provided.

…ance.md (#87)

…nfig-surface audit (#93)

# Conflicts: # CHANGELOG.md

dist/ave-records-latest.json content was already current (64 records); only the manifest's generated_at timestamp needed a bump. The repo's own regenerate-records-json.yml workflow tried to do this automatically twice (runs 30374721533, 30407737766) but failed both times at the PR-creation step: GitHub Actions is not permitted to create or approve pull requests in this repo's settings. Left a stale, superseded branch (chore/regenerate-dist-records) behind each time; not used here since it also reverts the dependabot version bumps that landed via the main-develop merge.

…rial instructions (#96)

# Conflicts: # CHANGELOG.md # dist/ave-records-latest.json # dist/ave-records-latest.manifest.json

Updated image width in README for better responsiveness.

…ting) (#113)

…ft) (#114)

…mo) (#116)

…ollaborative Shadows) (#117)

# Conflicts: # README.md # dist/ave-records-latest.manifest.json

…#191) Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

…ambiguous) (#196)

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

Resolves the conflict on PR #199 (develop -> main). Only real conflict was dist/ave-records-latest.manifest.json's generated_at timestamp; records/ itself merged cleanly (main never touched the 48 files #196 corrected). dist/ave-records-latest.json auto-merged without conflict markers and was verified byte-identical to a fresh regeneration via scripts/build-records.js, so no silent divergence there. Manifest regenerated fresh the same way rather than hand-picking a timestamp.

# Conflicts: # records/AVE-2026-00048.json

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

Signed-off-by: Sankalp Gilda <sankalp.gilda@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com> Co-authored-by: Nicolai <245527909+predictor2718@users.noreply.github.com> Co-authored-by: Empire Labs Pty Ltd <narko4u@gmail.com> Co-authored-by: narko4u <narko4u@users.noreply.github.com>

Signed-off-by: Sankalp Gilda <sankalp.gilda@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com> Co-authored-by: Nicolai <245527909+predictor2718@users.noreply.github.com> Co-authored-by: Empire Labs Pty Ltd <narko4u@gmail.com> Co-authored-by: narko4u <narko4u@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…s) (#224)

)

…ture (issue #218) (#220) Co-authored-by: narko4u <narko4u@users.noreply.github.com>

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

@@ -0,0 +1,75 @@
+import json
+import pytest


Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Nicolai <245527909+predictor2718@users.noreply.github.com> Co-authored-by: Empire Labs Pty Ltd <narko4u@gmail.com>

predictor2718 and others added 30 commits July 23, 2026 22:33

Add cfgaudit → AVE crosswalk (static config-auditor) (#67)

334bb96

docs: scaling and governance policy (#80)

f4d9b4e

docs: cross-reference scaling-and-governance.md in README (#83)

0ce799e

docs: cross-reference scaling-and-governance.md in CLAUDE.md (#82)

a367da6

docs: cross-reference scaling-and-governance.md in CONTEXT.md (#84)

79406d0

docs: cross-reference scaling-and-governance.md in CONTRIBUTING.md (#85)

798a9c6

docs: cross-reference scaling-and-governance.md in GOVERNANCE.md (#86)

43928ee

docs: add status glossary entry, cross-referencing scaling-and-govern…

ad2ecf2

…ance.md (#87)

docs: CHANGELOG entry for scaling-and-governance.md (#88)

e94a8de

docs: cross-reference scaling-and-governance.md in ARCHITECTURE.md (#89)

8fcc70b

feat: validate records and update skills (#91)

86a2a71

fix add ave record skill

a699f5e

feat: AVE-2026-00060 through 00064 -- five new records from policy/co…

5b2b340

…nfig-surface audit (#93)

Merge remote-tracking branch 'origin/main' into develop

fbbb422

# Conflicts: # CHANGELOG.md

feat: AVE-2026-00065 -- A2A agent card poisoning via embedded adversa…

f4cc426

…rial instructions (#96)

Merge remote-tracking branch 'origin/main' into develop

c9dce1e

# Conflicts: # CHANGELOG.md # dist/ave-records-latest.json # dist/ave-records-latest.manifest.json

fix: stale piranha.bawbel.io reference in README (#99)

445a178

docs: add researcher-process.md (#101)

a08240e

chore: add ave gap diagram (#107)

8955456

fix: GOVERNANCE.md deprecation_reason field claim (#106)

e1fe630

docs: add API link and gap diagram to README (#108)

2789ac1

Change image width to 100% in README

e5953c6

Updated image width in README for better responsiveness.

docs: link AVE-2026-00046 writeup from its own record (#111)

b464ed9

feat: AVE-2026-00066 -- hallucinated skill-name squatting (HalluSquat…

d8861a5

…ting) (#113)

feat: AVE-2026-00067 -- skill composition trust transfer (SCR-TrustLi…

46fc1ce

…ft) (#114)

feat: AVE-2026-00068 -- CLI command composition risk (MOSAIC) (#115)

c302152

feat: AVE-2026-00069 -- multimodal image-hidden instructions (SkillCa…

270a263

…mo) (#116)

feat: AVE-2026-00070 -- distributed cross-agent backdoor fragments (C…

34a692f

…ollaborative Shadows) (#117)

Merge remote-tracking branch 'origin/main' into develop

211f71c

# Conflicts: # README.md # dist/ave-records-latest.manifest.json

chaksaray and others added 25 commits August 15, 2026 21:15

feat: skillsentry-to-ave and skill-security-scanner-to-ave crosswalks (…

8ec7c2f

…#191) Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

docs: owasp_asi tagging rule, from the #196 audit (#197)

604498a

fix: owasp_asi mapping audit (48 corrected, 13 confirmed, 11 flagged …

b5e33bd

…ambiguous) (#196)

chore: regenerate consolidated records JSON (#198)

9365f00

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

fix: AVE-2026-00048 attribution and remediation branding (#202)

c494f8c

Merge remote-tracking branch 'origin/main' into develop

236360e

# Conflicts: # records/AVE-2026-00048.json

Sync main into develop, resolves PR #204's conflict (#206)

8e910fc

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

chore: regenerate consolidated records JSON (#203)

a1e50c1

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

fix: researcher-attribution audit across the corpus (49 of 50) (#205)

228d545

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

chore: regenerate consolidated records JSON (#207)

3048d1f

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

Sync main into develop, resolves PR #204's conflict (#209)

00b69c5

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

Sync main into develop, resolves PR #204's conflict (again) (#210)

858d46d

Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com> Co-authored-by: Sankalp Gilda <sankalp.gilda@gmail.com>

docs: fix stale independent-crosswalk count in README (3 -> 8) (#200)

759dddf

docs: three real improvements surfaced by external critique (#215)

e843ea5

fix conflic test validate data

070b8ca

fix generated at manifest

4827171

docs: capability-behavior-vulnerability taxonomy audit (all 80 record…

824279a

…s) (#224)

crosswalks: refresh cfgaudit to v1.13.0 (64 rules onto 27 classes) (#193

18da735

)

docs: cross-reference the boundary-failure record family (#233)

742d897

Apply external_authority to AVE-2026-00074, clearing its enum-gap fix…

8dcddde

…ture (issue #218) (#220) Co-authored-by: narko4u <narko4u@users.noreply.github.com>

feat: standing capability-vulnerability taxonomy check (#231)

543bb3b

chore: regenerate consolidated records JSON (#235)

81c3665

Co-authored-by: chaksaray <15962335+chaksaray@users.noreply.github.com>

github-code-quality Bot found potential problems Aug 30, 2026

View reviewed changes

Comment thread tests/test_vulnerability_taxonomy.py

@@ -0,0 +1,75 @@

import json

import pytest

chaksaray mentioned this pull request Aug 30, 2026

Sync main into develop, resolves PR #238's conflict #239

Merged

chaksaray and others added 2 commits August 30, 2026 08:01

fix generate manifest time

f68e888

chaksaray merged commit 4e63225 into main Aug 30, 2026
12 checks passed

Navigation Menu

Uh oh!

feat: standing capability-vulnerability taxonomy check- #231 - #238

feat: standing capability-vulnerability taxonomy check- #231#238
chaksaray merged 104 commits into
mainfrom
develop

chaksaray commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

chaksaray commented Aug 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants