mirror of
https://github.com/ipxe/ipxe.git
synced 2026-08-26 13:17:22 -05:00
Michael Brown
0f4a37bc3a
Add the instructions that Claude developed for itself over the course of a very interactive week-long security audit of the iPXE codebase. These instructions are to be used to guide any future use of AI agents to search for security issues in iPXE. Agents that follow these instructions are expected to surface only relevant information, write up suitably minimalistic reports (unlike the typical unguided AI slop that resulted in iPXE's current "(Ab)use of AI" policy), and guide submission through the appropriate channels that have been set up and documented in the security policy. Any AI-authored reports are directed towards the "ipxe/aipxe" sandbox repository, which exists to provide a clear separation between human-generated and AI-generated content. Given that repeated passes with Claude Opus 4.8 (and a cross-check with Claude Fable) have converged to a clean state, it is expected that publishing these instructions will lead to at most a trickle of submissions, and that any such submissions should end up being genuinely useful. These instructions were written by Claude (with many hours of guidance and refinement) and have not been modified, on the basis that an AI agent knows best about what documentation it will itself find useful. Unnecessary duplication has been avoided by documenting the key points (e.g. bounds contracts) within the code's own Doxygen comments for reference by both humans and agents, and ensuring that Claude's own instructions refer and defer to this authoritative documentation. Claude has not authored any code that was committed as part of this week-long project. The AI agent instructions added by this commit remain the only AI-authored content present in the tree. I have set myself as the commit author (with an appropriate Authored-by credit for Claude), written this commit message myself, and added my own signoff, to confirm that I am the human owner taking long-term responsibility for this contribution, regardless of its origin. Authored-by: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Michael Brown <mcb30@ipxe.org>
806 B
806 B
iPXE — Claude Code guidance
Agent conventions for this repository are tool-neutral and live in
AGENTS.md — follow them. This file adds only the Claude
Code-specific pieces.
- Security review: for vulnerability-hunting work, invoke the
ipxe-security-review skill
(
.claude/skills/ipxe-security-review/). It encodes the sweep procedure and the terse reporting format described inAGENTS.md. - Codebase knowledge is at the source. The bounds contracts of core
helpers (
iob_*,asn1_cursor,xferbuf_*,ssnprintf) and the coding patterns (composable cleanup, count-then-clamp) are documented in Doxygen documentation blocks at the source, indexed from the Notes section ofdoc/threat_model.dox. Treat those as authoritative; do not re-derive them.