Added simple assistant plugin example (#734)
Build and Release / Build app (${{ matrix.dotnet_runtime }}) (-x86_64-apple-darwin, osx-x64, macos-latest, x86_64-apple-darwin, dmg,updater, dmg) (push) Blocked by required conditions
Build and Release / Build app (${{ matrix.dotnet_runtime }}) (-x86_64-pc-windows-msvc.exe, win-x64, windows-latest, x86_64-pc-windows-msvc, nsis,updater, nsis) (push) Blocked by required conditions
Build and Release / Build app (${{ matrix.dotnet_runtime }}) (-x86_64-unknown-linux-gnu, linux-x64, ubuntu-22.04, x86_64-unknown-linux-gnu, appimage,deb,updater, appimage,deb) (push) Blocked by required conditions
Build and Release / Prepare & create release (push) Blocked by required conditions
Build and Release / Determine run mode (push) Waiting to run
Build and Release / Read metadata (push) Blocked by required conditions
Build and Release / Build app (${{ matrix.dotnet_runtime }}) (-aarch64-apple-darwin, osx-arm64, macos-latest, aarch64-apple-darwin, dmg,updater, dmg) (push) Blocked by required conditions
Build and Release / Build app (${{ matrix.dotnet_runtime }}) (-aarch64-pc-windows-msvc.exe, win-arm64, windows-latest, aarch64-pc-windows-msvc, nsis,updater, nsis) (push) Blocked by required conditions
Build and Release / Build app (${{ matrix.dotnet_runtime }}) (-aarch64-unknown-linux-gnu, linux-arm64, ubuntu-22.04-arm, aarch64-unknown-linux-gnu, appimage,deb,updater, appimage,deb) (push) Blocked by required conditions
Build and Release / Publish release (push) Blocked by required conditions

This commit is contained in:
nilskruthoff authored and GitHub committed 2026-04-15 09:01:31 +02:00
1 parent da62814b2f
commit e5d8ac4a71
13 files changed
+423 -24

No files matched your search

@@ -62,6 +62,7 @@ public sealed class AssistantAuditAgent(ILogger<AssistantAuditAgent> logger, ILo
- Pay special attention to risky or abusable Lua basic-library features and global-state primitives such as `load`, `loadfile`, `dofile`, `collectgarbage`, `getmetatable`, `setmetatable`, `rawget`, `rawset`, `rawequal`, `_G`, or patterns that dynamically execute code, inspect or alter hidden state, bypass expected data flow, or make behavior harder to review.
- If such Lua features are used in a way that could execute hidden code, mutate runtime behavior, evade review, tamper with guardrails, access unexpected files or modules, or conceal the plugin's real behavior, treat that as strong evidence for at least CAUTION and often DANGEROUS depending on impact and clarity.
- When these risky Lua features appear, explicitly evaluate whether their usage is necessary and transparent for the assistant's stated purpose, or whether it creates an unnecessary attack surface even if the manifest otherwise looks benign.
- `LogInfo`, `LogDebug`, `LogWarning`, `LogError`, `InspectTable`, `DateTime` and `Timestamp` are C# helper methods that we provide and usually not necessarily DANGEROUS. Audit the usage and decide if its for Debugging only and if so mark as SAFE.
- Mark the plugin as CAUTION only when there is concrete evidence of meaningful risk or ambiguity that deserves manual review.
- Mark the plugin as SAFE only when no meaningful risk is apparent from the provided material.
- A SAFE result should normally have no findings. Do not add low-value findings just to populate the array.