[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load — 23 new concepts crammed before exercises
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 85/100
- Issue type
- Documentation
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github-actions
- Domain
- content, documentation
Research direction
Start with workshop/side-quest-17-07-repo-poisoning.md, especially the “How AW Defends Against It” section and its four subsections. Add the requested per-defense checks, consider trimming or moving nonessential material, preserve the existing learning objectives and checkpoint, and run npx --yes markdownlint-cli2 "**/*.md". Done means the file is lint-clean and its cognitive-load and activity-density concerns are addressed.
Written by the indexing model from the issue text.
Description
File: workshop/side-quest-17-07-repo-poisoning.md
Overall Score: 5.0 / 10.0 (corpus mean: 6.1)
Flagged Dimensions:
| Dimension | Score | Benchmark | Delta |
|---|---|---|---|
| active_learning | 2.7 | ≥ activity density 3 (score 10) | -7.3 |
| cognitive_load | 5.9 | ≤ 800 words / ≤ 15 new concepts (score 10) | -4.1 |
Note: the rubric also flags missing_checkpoint, but this is a confirmed tooling bug (see scorecard issue) — the file has a well-formed ## :white_check_mark: Checkpoint with 6 specific checklist items. Dismissed.
Root Cause (≤ 2 sentences):
The page introduces 23 new concepts (permissions blocks, contents: read, safe-outputs: create-pull-request, protected-files, network.allowed-domains, PR routing, path restriction, etc.) across 9 h2 sections in 1,224 words, exceeding the 15-concept cognitive-load ceiling by more than 50%. Two "Exercise" sections ask learners to identify dangerous frontmatter and harden a workflow, but at density 0.82 the surrounding defensive-technique explanations (four distinct YAML configuration patterns) are delivered as dense prose before those exercises, front-loading concepts rather than interleaving practice.
Evidence (quoted from the file):
Repository poisoning is what happens when a misdirected agent with write access commits changes an attacker designed — not changes the workflow author intended.
gh-aw gives you three layers to prevent repository poisoning.
Learning Science Rationale:
Sweller's Cognitive Load Theory predicts that presenting four distinct configuration mechanisms (read-only permissions, PR routing, path restriction, network allow-listing) as sequential prose paragraphs before any hands-on check overloads working memory, especially when each mechanism carries its own YAML syntax and rationale. Splitting the exposition into smaller worked-example chunks with immediate micro-checks (segmenting principle) would let learners consolidate each defense before the next is introduced, rather than holding all four in memory until the exercises at the bottom of the page.
Improvement Prompt (for an agent):
Edit workshop/side-quest-17-07-repo-poisoning.md to reduce cognitive load and raise activity density. Under "How AW Defends Against It," after each of the four ### subsections (Declare read-only permissions, Route writes through a pull request, Restrict which paths can change, Limit network destinations), insert a short one-line "Quick check" prompt or a 1-item micro-exercise (e.g., a code snippet to fix) tied to that specific defense, instead of leaving both exercises stacked at the end of the page. Consider trimming or moving one of the four defense subsections into a linked follow-up if it is not essential to this side quest's core objective, to bring new-concept count closer to 15-18. Keep the existing checkpoint and learning objectives unchanged. Run npx --yes markdownlint-cli2 "**/*.md" after editing.
Expected Score After Fix: 6.1 / 10.0
Generated by 🔬 Curriculum Quality Evaluator · copilot · auto · 74.5 AIC · ⌖ 11.9 AIC · ⊞ 9K · ◷
- expires on Sep 23, 2026, 3:48 AM UTC
- Dominant language
- JavaScript
- Stars
- 52
- Forks
- 26
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 15
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from githubnext/gh-aw-workshop
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 88/100
githubnext/gh-aw-workshop#4496 ·
Maintainers usually reply within 1 day
-
feedback simulation workshop
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
githubnext/gh-aw-workshop#4495 ·
Maintainers usually reply within 1 day
-
feedback simulation workshop
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
githubnext/gh-aw-workshop#4494 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
githubnext/gh-aw-workshop#4491 ·
Maintainers usually reply within 1 day
-
[workshop-sync] workshop/06-install-gh-aw.md: inaccurate gh aw init output and stale version exampleOpendocumentation
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-workshop#4490 ·
Maintainers usually reply within 1 day
All issues in githubnext/gh-aw-workshop
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 76/100
521xueweihan/HelloGitHub#3939 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
needs-website-changes
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
[Bug] critique requires the detector on native targets, but audit.native.md says it does not applyOpenneeds triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
pbakaus/impeccable#1017 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day