Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[curriculum-eval] side-quest-17-07-repo-poisoning.md: cognitive_load — four defense layers taught in one uninterrupted pass (23 concepts)

オープン 初心者向け
  • 何か問題がありますか？
#3,897 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
78/100
issue の種類
ドキュメント
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
markdown
領域
content, documentation

調査の方向性

workshop/side-quest-17-07-repo-poisoning.md を開き、導入部と名前の付いた4つの防御サブセクションを確認してください。レイヤー数の表現を確認し、既存の演習と最後の Checkpoint は変更せずに、最初の2つのサブセクションの後に要求されたセルフチェックを配置してください。ページが合意されたレイヤー構造を反映し、中間検索チェックリストを含んでいれば完了です。

索引モデルが issue の本文から書いたものです。

説明

curriculum documentation quality

File: workshop/side-quest-17-07-repo-poisoning.md
Overall Score: 4.95 / 10.0 (corpus mean: 6.09) — second-lowest score in the corpus
Corrected Overall Score (after fixing the checkpoint/scaffolding regex bug reported separately): 7.70 / 10.0 — cognitive_load and active_learning remain the residual gaps.

Flagged Dimensions:

Dimension Score Benchmark Delta
cognitive_load 5.8 ≤800 words, ≤15 new concepts -2.1 (1234 words, 54% over target) and -4.0 (23 concepts, 53% over the 15-concept ceiling)
active_learning 2.7 density ≥ 3 -0.3 (density 0.81)

Root Cause (≤ 2 sentences):
This page teaches four independent defense layers in one pass (contents: read permissions, safe-outputs: create-pull-request, protected-files path restrictions, and network.allowed-domains), each introducing its own distinct frontmatter syntax and config keys, which drives the concept count to 23 — the highest new-concept load flagged in the corpus alongside the highest word count among findings.

Evidence (quoted from the file):

"gh-aw gives you three layers to prevent repository poisoning."

[followed by four ##-level subsections: "Declare read-only permissions", "Route writes through a pull request", "Restrict which paths can change", "Limit network destinations" — each with its own YAML frontmatter example]

The intro promises "three layers" but the page actually walks through four distinct defensive mechanisms back-to-back with no intermediate checkpoint, each requiring the learner to hold the prior mechanism's syntax in memory while absorbing the next.

Learning Science Rationale:
Sweller's Cognitive Load Theory identifies "element interactivity" as the key driver of intrinsic load: concepts that must be understood simultaneously (here, four defensive YAML configurations that compose together) impose far more working-memory burden than an equivalent word count of independent facts. Presenting all four defenses in one uninterrupted pass before any practice or self-check risks exceeding working memory capacity (typically cited as ~4 chunks), especially for the corpus's most content-dense side quest.

Improvement Prompt (for an agent):

In workshop/side-quest-17-07-repo-poisoning.md, reduce concept density and add mid-page retrieval practice:

1. Fix the intro line "gh-aw gives you three layers to prevent repository poisoning." to say "four layers" (it currently undercounts the four subsections that follow: read-only permissions, safe-outputs PR routing, protected-files path restrictions, and network.allowed-domains) — or alternatively, merge "Restrict which paths can change" into the "Route writes through a pull request" section as a sub-point, since protected-files is a modifier of create-pull-request rather than a standalone layer, reducing four taught layers to three.

2. After the first two subsections ("Declare read-only permissions" and "Route writes through a pull request"), insert a short 2-item checklist self-check before continuing to the remaining layers, e.g.:
   - [ ] I can explain why `contents: read` alone prevents a direct commit
   - [ ] I can explain what `create-pull-request` adds on top of read-only permissions

   This breaks the four-layer block into two smaller chunks with a retrieval checkpoint between them, reducing simultaneous element interactivity.

3. Keep the existing "Spot the Dangerous Frontmatter" and "Harden Your Workflow" exercises and the final Checkpoint unchanged.

Expected Score After Fix: ≈8.2 / 10.0 (concept load reduced from 23 toward ~17-18 by merging protected-files under create-pull-request; activity_density raised slightly by the added mid-page checklist; combined with the companion checkpoint/scaffolding regex fix already applied in the corrected baseline).

Generated by 🔬 Curriculum Quality Evaluator · copilot · auto · 147.3 AIC · ⌖ 18.6 AIC · ⊞ 9K · ◷

  • expires on Sep 28, 2026, 9:51 AM UTC
主要言語
JavaScript
スター
49
フォーク
20
平均マージ
7時間 55分
マージ済み PR（30日）
30

環境構築

このプロジェクトの環境構築ファイルはまだ確認していません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

githubnext/gh-aw-workshop のほかの issue

githubnext/gh-aw-workshop の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。