Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load/active_learning — lowest-scored page in corpus, four defenses crammed into on

Cerrado Apto para principiantes
  • ¿Algo no está bien?
#3,975 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
Medio día
Aptitud para principiantes
78/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, markdown
Área
documentation, security

Línea de trabajo

Lee workshop/side-quest-17-07-repo-poisoning.md y revisa los objetivos de aprendizaje, la tabla de resumen, la narrativa del ataque y los dos ejercicios. Reorganiza y acorta la página como se describe, conservando ambos ejercicios y las tres defensas. Vuelve a ejecutar el script de rúbrica del currículo y confirma que el recuento de palabras, el recuento de conceptos y la densidad de actividades mejoran hacia los objetivos indicados.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

curriculum documentation quality

File: workshop/side-quest-17-07-repo-poisoning.md
Overall Score: 4.95 / 10.0 (corpus mean: 6.09 / 10.0, lowest score in the entire corpus)

Flagged Dimensions:

Dimension Score Benchmark Delta
cognitive_load 5.8 ≤800 words, ≤15 concepts (has 1234 words, 23 concepts) -4.2
active_learning 2.7 density ≥3 (has 0.81) -6.3

Note: this page's checkpoint_quality and scaffolding scores are also suppressed by the regex bug documented in the companion "curriculum_assessment.py" issue (the page has a proper ## :white_check_mark: Checkpoint and ## :clipboard: Before You Start); this finding covers only the two dimensions that are genuinely low regardless of that bug.

Root Cause (≤ 2 sentences):
This "create"-level side quest crams four distinct defensive mechanisms (contents: read, safe-outputs: create-pull-request, allowed-files/protected-files, network.allowed-domains) plus a full attack-scenario narrative and two separate frontmatter-reading exercises into 1,234 words with only 4 code blocks — well above the corpus's ideal word count and concept ceiling, and its activity density (0.81) sits far below the ≥3 target expected for a page whose own learning objectives promise the reader will "Apply the three gh-aw defences."

Evidence (quoted from the file):

By the end of this side quest you will be able to: Explain what repository poisoning is and why agentic workflows are uniquely vulnerable to it. Identify dangerous permissions: and toolsets: values in a workflow frontmatter. Apply the three gh-aw defences: contents: read, safe-outputs: create-pull-request, and network.allowed-domains.

Learning Science Rationale:
Bloom's Taxonomy classifies this page at "create" (the highest cognitive level), which is appropriate for its content, but Cognitive Load Theory (Sweller) warns that high-order tasks are especially sensitive to extraneous load — asking a learner to apply three separate defensive mechanisms while simultaneously introducing the attack narrative, a permissions table, and two "spot the danger" exercises in one continuous page risks overwhelming working memory before the learner reaches the hands-on "Harden Your Workflow" exercise, which is the page's actual highest-value activity.

Improvement Prompt (for an agent):

In workshop/side-quest-17-07-repo-poisoning.md, reduce cognitive load without losing security content:

1. Move the "What You Can Do as a Workflow Author" summary table to immediately after the "Learning Objectives" section (near the top) so readers have a compact reference before reading the three long defensive-mechanism subsections — this lets them skim the table first and treat the detailed prose as optional deep-dive rather than required linear reading.
2. Shorten "The Attack" narrative paragraph and the "Why This Matters" paragraph by combining them into a single paragraph — both currently make a similar point (agents reason over untrusted content, so write access is dangerous) using different words.
3. Keep both "Exercise: Spot the Dangerous Frontmatter" and "Exercise: Harden Your Workflow" — these are the strongest active-learning components on the page and should not be cut; if anything, consider adding one more short code-block example between the three defensive-mechanism subsections to raise activity_density above the current 0.81 without adding narrative words.
4. Target a final word count closer to 900-1000 (from 1234) and confirm new_concepts count drops from 23 toward the corpus median of ~12-15 by re-running the rubric script after edits.

Expected Score After Fix: 6.4 / 10.0 (after also applying the checkpoint/scaffolding regex fix from the companion issue, likely closer to 8.1 / 10.0)

Generated by 🔬 Curriculum Quality Evaluator · copilot · auto · 134.5 AIC · ⌖ 17.6 AIC · ⊞ 9K · ◷

  • expires on Sep 30, 2026, 11:52 AM UTC
Lenguaje dominante
JavaScript
Estrellas
55
Forks
36
Merge medio
2 d 8 h
PR fusionados (30 d)
17

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

  • Sin Dockerfile ni archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de githubnext/gh-aw-workshop

Todos los issues de githubnext/gh-aw-workshop

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.