taltara/capmark

README 摘要

capmark Capability manifests for AI agent plugins. A plugin declares what it may do, in Markdown, and a checker holds it to that. Installing a plugin runs someone else's code with your permissions — it can read your files, spend your credentials, and reach the network. Today the only thing standing between you and that is a README and your own reading of it. Scanners look for known-bad code after the fact. capmark is the other half: the plugin says what it needs up front, in a form a machine can check. cap grant fs:read scope=workspace grant net:fetch ​ cap never proc:spawn require approval for fs:read ​ It is Markdown first. A reader that has never heard of capmark still renders a legible security README — the worst case for an unsupported manifest is documentation. The rule that keeps this honest Every capability in the vocabulary must name a mechanism that actually stops it. This is not a style preference. DSH discussion 174 recorded a deny rule on rm -rf being walked around with rm followed by rmdir in the same run. Patterns deny spellings. Capabilities deny outcomes. Denying a whole tool is not pattern matching — there is no way to rephrase your way to bash once bash is off th…

分类