Skip to content

Fix: create-expert internal experts lack pick for minimal privilege #350

@FL4TLiN3

Description

@FL4TLiN3

Description

The internal experts defined in apps/create-expert/src/lib/create-expert-toml.ts do not use the pick option to restrict tool access, violating the minimal privilege principle emphasized in the documentation.

Current Behavior

All internal experts define @perstack/base skill without pick:

[experts."create-expert".skills."@perstack/base"]
type = "mcpStdioSkill"
command = "npx"
packageName = "@perstack/base"

This pattern is repeated for all 8 internal experts:

  • create-expert
  • property-extractor
  • ecosystem-builder
  • integration-manager
  • functional-manager
  • usability-manager
  • expert-tester
  • report-generator

Expected Behavior

Each expert should use pick to only expose the tools it actually needs, as documented in:

  • docs/making-experts/skills.md: "Use pick/omit to control which tools are available"
  • docs/making-experts/best-practices.md: "Use Minimal Privilege"

For example:

  • property-extractor likely only needs ["think", "attemptCompletion"]
  • ecosystem-builder needs ["readTextFile", "editTextFile", "think", "attemptCompletion"]
  • expert-tester needs ["exec", "think", "attemptCompletion"]

Affected Areas

  • apps/create-expert/src/lib/create-expert-toml.ts:618-725 (all skill definitions)

Acceptance Criteria

  • Each internal expert uses pick with only the tools it requires
  • Tool selections are documented in comments

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingcreate-expertcreate-expert CLI package

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions