Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load — 23 new concepts with no intermediate recall checkpoints

Closed Beginner friendly
  • Is something wrong?
#3,811 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
90/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Tech stack
markdown
Domain
documentation

Research direction

Open workshop/side-quest-17-07-repo-poisoning.md and review the sections named in the improvement prompt, especially the four defensive mechanisms and the two prose sections. Add the two recall checkpoints, trim the specified prose while preserving the existing exercises, checkpoint, and code blocks, then run npx --yes markdownlint-cli2 "workshop/side-quest-17-07-repo-poisoning.md". Done means the requested content changes are present and no lint errors remain.

Written by the indexing model from the issue text.

Description

curriculum documentation quality

File: workshop/side-quest-17-07-repo-poisoning.md
Overall Score: 4.95 / 10.0 (corpus mean: 6.09 / 10.0)

Flagged Dimensions:

Dimension Score Benchmark Delta
cognitive_load 5.8 10.0 (≤ 800 words, ≤ 15 new concepts) -4.2 (1,234 words, 23 new concepts)
active_learning 2.7 10.0 (density ≥ 3) -7.3

Root Cause (≤ 2 sentences):
The page introduces 23 new bolded/code-formatted terms (contents: write, toolsets: [everything], protected-files, allowed-files, network.allowed-domains, etc.) across 1,234 words of dense security-configuration prose — nearly 3x the ideal concept density (15 per step) — and its two exercises are read-then-reveal <details> blocks rather than hands-on activities, so activity density (0.81) sits far below the 3.0 benchmark despite four YAML code blocks.

Evidence (quoted from the file):

"The simplest defence is removing write capability before the agent runs" ... followed immediately by a fenced YAML block, then a second YAML block for create-pull-request, then a table of protected-files fields, then a third code block for network.allowed-domains — four distinct configuration concepts introduced back-to-back with no intermediate checkpoint or recall activity.

Learning Science Rationale:
Sweller's Cognitive Load Theory predicts that presenting four related-but-distinct defensive mechanisms (contents: read, create-pull-request, protected-files, network.allowed-domains) in immediate sequence without an intervening retrieval-practice step overloads intrinsic load, especially for a security topic where learners must also track why each defense matters, not just its syntax. Spacing the reveal-based exercises with an explicit low-stakes recall checkpoint between concept blocks would let learners consolidate before the next defense is introduced.

Improvement Prompt (for an agent):

Edit workshop/side-quest-17-07-repo-poisoning.md to reduce concept density and add active
recall between the four defensive mechanisms (contents: read, create-pull-request,
protected-files, network.allowed-domains):

1. After the "Declare read-only permissions" subsection and before "Route writes through a
   pull request," insert a one-line self-check prompt such as: "Before continuing: can you
   explain in one sentence why contents: read alone stops repository poisoning?" using a
   <details><summary>Check yourself</summary> reveal block with a one-sentence answer.

2. Add a similar brief self-check after the "Restrict which paths can change" table, before
   "Limit network destinations," so learners consolidate the permissions + safe-outputs
   pairing before the network-layer defense is introduced.

3. Shorten the two prose paragraphs under "The Attack" and "Why This Matters" sections by
   roughly 25% each, keeping the core scenario (issue body carrying a hidden YAML payload)
   and the definition of content-driven manipulation intact, to bring total word count from
   1,234 toward ~950-1000.

4. Keep both existing "Exercise" sections, the Checkpoint section, and all four code blocks
   verbatim — only add the two recall checkpoints and trim prose length.

5. Run `npx --yes markdownlint-cli2 "workshop/side-quest-17-07-repo-poisoning.md"` and fix
   any lint errors introduced.

Expected Score After Fix: 6.0 / 10.0 (reduced word count plus two added recall checkpoints raises both cognitive_load and active_learning scores).

Generated by 🔬 Curriculum Quality Evaluator · copilot · auto · 90.7 AIC · ⌖ 21.1 AIC · ⊞ 9K · ◷

  • expires on Sep 26, 2026, 7:53 AM UTC
Dominant language
JavaScript
Stars
49
Forks
20
Avg merge
7h 22m
Merged PRs (30d)
33

Getting set up

We have not checked this project's setup files yet. Start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from githubnext/gh-aw-workshop

All issues in githubnext/gh-aw-workshop

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.