Security: dcadolph/kibble

Security

docs/SECURITY.md

Security model

kibble executes commands it read out of a repository's documentation. That is the product, and it means a README is untrusted input: anyone who can change the docs can change what runs. Treat a kibble run the way you treat a build script.

Every command runs inside a fresh container that is removed afterward, with bounded memory and process counts, no-new-privileges, and every Linux capability dropped except the handful apt needs to install the packages the docs depend on. Nothing from the host is mounted in; the repository is streamed in as a tar of its working tree.

The boundary that stays open is the network, because verifying an install is fetching it: go install, cargo install, and npm install -g are network operations. A malicious documented command can therefore reach out from inside the container. The container is disposable and unprivileged, but Docker isolation is a wall, not a guarantee. So:

  • Running kibble on your own repository in CI is the designed case: anyone who can edit your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's chosen commands on your Docker daemon. Do it the way you would run their Makefile: in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only the documented lines the engine could not settle, and the Ollama route keeps even that on your own machine.

In CI, the GitHub Action downloads the released binary for the version you pinned and verifies its checksum against the release's checksums.txt before running it, so a CI log can say which kibble produced its verdict.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: dcadolph/kibble
Security

docs/SECURITY.md

Security model
kibble executes commands it read out of a repository's documentation. That is the
product, and it means a README is untrusted input: anyone who can change the docs can
change what runs. Treat a kibble run the way you treat a build script.
Every command runs inside a fresh container that is removed afterward, with bounded
memory and process counts, no-new-privileges, and every Linux capability dropped except
the handful apt needs to install the packages the docs depend on. Nothing from the host
is mounted in; the repository is streamed in as a tar of its working tree.
The boundary that stays open is the network, because verifying an install is fetching
it: go install, cargo install, and npm install -g are network operations. A
malicious documented command can therefore reach out from inside the container. The
container is disposable and unprivileged, but Docker isolation is a wall, not a
guarantee. So:
  • Running kibble on your own repository in CI is the designed case: anyone who can edit
your README can already edit your workflows.
  • Running kibble against a repository you do not trust is running that repository's
chosen commands on your Docker daemon. Do it the way you would run their Makefile:
in a sandbox you are prepared to lose.
  • Default kibble never contacts a model provider. Only -suggest does, it sends only
the documented lines the engine could not settle, and the Ollama route keeps even
that on your own machine.
In CI, the GitHub Action downloads the released binary for the version you pinned and
verifies its checksum against the release's checksums.txt before running it, so a CI
log can say which kibble produced its verdict.
 There aren't any published security advisories