Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load — four security mechanisms introduced back-to-back with no interleaved checks

Cerrado Apto para principiantes
  • ¿Algo no está bien?
#4,528 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
75/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
javascript
Área
documentation

Línea de trabajo

Lee workshop/side-quest-17-07-repo-poisoning.md, centrándote en “How AW Defends Against It” y los dos ejercicios existentes. Añade una breve autoevaluación plegada después de cada uno de los cuatro apartados sobre las defensas, deja sin cambios los ejercicios capstone y evita repetir la comparación de toolsets. La tarea estará terminada cuando estén las cuatro autoevaluaciones y se ejecute correctamente el comando markdownlint solicitado.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

curriculum documentation quality

File: workshop/side-quest-17-07-repo-poisoning.md
Overall Score: 4.95 / 10.0 (corpus mean: 6.09)

Flagged Dimensions:

Dimension Score Benchmark Delta
cognitive_load 5.8 ≤800 words, ≤15 new concepts → 10.0 -4.2 (1,234 words, 23 new concepts)
active_learning 2.7 activity density ≥ 3 → 10.0 -7.3

Root Cause (≤ 2 sentences):
The page introduces 23 distinct bolded/code terms (contents: read, contents: write, safe-outputs, allowed-files, protected-files.exclude, protected-files.policy, network.allowed-domains, toolsets: [everything], etc.) across four stacked defence sections before the learner ever applies any of them, and its two <details> exercises are the only interactive elements in 1,234 words of prose (activity_density 0.81). This front-loads an unusually high concept count for a single side quest relative to the ≤15 ideal.

Evidence (quoted from the file):

gh-aw gives you three layers to prevent repository poisoning.

Declare [read-only permissions]... ### Route writes through a pull request ... ### Restrict which paths can change ... ### Limit network destinations

Learning Science Rationale:
Sweller's Cognitive Load Theory predicts that introducing four related-but-distinct security mechanisms (permissions, safe-outputs, protected-files, network allow-lists) back-to-back as pure exposition — each with its own YAML snippet and terminology — exceeds working-memory capacity before any single mechanism is rehearsed, increasing extraneous load and reducing transfer to the "Harden Your Workflow" exercise that follows. Spacing retrieval practice between each new concept (rather than clustering all four, then testing all four at once) is a well-established mitigation for this kind of sequential concept pile-up.

Improvement Prompt (for an agent):

Open workshop/side-quest-17-07-repo-poisoning.md. The "How AW Defends Against It" section
currently presents four defence mechanisms (contents: read, safe-outputs: create-pull-request,
protected-files, network.allowed-domains) back-to-back with no interleaved check-for-
understanding. Do the following:

1. After each of the four ### subsections under "How AW Defends Against It" (Declare read-only
   permissions / Route writes through a pull request / Restrict which paths can change / Limit
   network destinations), insert one short self-check question in a collapsed <details> block,
   e.g. after "Declare read-only permissions":
   <details>
   <summary>Quick check: what can the agent NOT do with contents: read?</summary>
   It cannot call any GitHub API that creates or modifies repository content, even if a hijacked
   prompt instructs it to.
   </details>

2. Keep the existing "Spot the Dangerous Frontmatter" and "Harden Your Workflow" exercises
   unchanged — they remain the capstone application step after the four mini-checks.

3. Verify the total new-concept count stays bounded by considering whether "toolsets:
   [everything]" vs "toolsets: [default]" can be mentioned once (in the exercise) rather than
   introduced twice.

4. Re-run `npx --yes markdownlint-cli2 "workshop/side-quest-17-07-repo-poisoning.md"` after
   editing.

Expected Score After Fix: 6.3 / 10.0 (active_learning and cognitive_load improvements; checkpoint_quality already correct via shortcode once the tooling regex fix lands).

Generated by 🔬 Curriculum Quality Evaluator · copilot · auto · 124.3 AIC · ⌖ 8.34 AIC · ⊞ 10.4K · ◷

  • expires on Oct 14, 2026, 4:56 AM UTC
Lenguaje dominante
JavaScript
Estrellas
53
Forks
35
Merge medio
13 h 50 min
PR fusionados (30 d)
14

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

  • Sin Dockerfile ni archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de githubnext/gh-aw-workshop

Todos los issues de githubnext/gh-aw-workshop

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.