From 581f469b2ff50bd6a4f4e836dc17086fcce81427 Mon Sep 17 00:00:00 2001 From: GangGreenTemperTatum <104169244+GangGreenTemperTatum@users.noreply.github.com> Date: Fri, 12 Jun 2026 09:38:28 -0400 Subject: [PATCH] fix(web-security): add anti-fabrication guard to report-writer trace_id Report-writer now explicitly instructs agents to extract the UUID from the [trace_id:] token and set "MISSING" if absent, preventing agents from inventing IDs when the tool response lacks one. Co-Authored-By: Claude Opus 4.6 (1M context) --- capabilities/web-security/skills/report-writer/SKILL.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/capabilities/web-security/skills/report-writer/SKILL.md b/capabilities/web-security/skills/report-writer/SKILL.md index 8a9cd66..eac674a 100644 --- a/capabilities/web-security/skills/report-writer/SKILL.md +++ b/capabilities/web-security/skills/report-writer/SKILL.md @@ -32,8 +32,9 @@ NNN = next sequential number (zero-padded: 001, 002, ...). slug = lowercase-hyph ## Confidence Trace -- Use the `trace_id` returned by the final `assess_confidence` call for this report. -- Copy that value into the report metadata so the report can be correlated with the confidence check. +- Extract the UUID from the `[trace_id:]` token in the `assess_confidence` tool response +- Copy that value into the report `confidence_trace_id` frontmatter field +- If the tool response does NOT contain `[trace_id:]`, set `confidence_trace_id: "MISSING"` — NEVER fabricate or guess an ID ## PoC Rules