[garymike]

dev-exec-writes-agent-memory required the quote to follow open( immediately, so every Python string prefix walked straight through the gate.

Found because NVIDIA/SkillSpector#893 was sent back in review for the same class of bug in its own analyzer. Its cause was different (it stripped the backslashes; we rejected the prefix), so pointing that finding at our own rule is what surfaced ours. Same method that produced the 1.7.1 fixes: run the upstream boundary case against our gate, not just against theirs.

Measured before this change

Ten cases wrong: eight false negatives, two false positives.

case	before	after
open(r"MEMORY.md", "a")	no finding	blocked
open(r"C:\Users\alice\MEMORY.md", "a")	no finding	blocked
open(rf"{base}\MEMORY.md", "a")	no finding	blocked
open(f"{base}/MEMORY.md", "a")	no finding	blocked
open(R"MEMORY.md", "a")	no finding	blocked
Path(r"C:\Users\MEMORY.md").write_text(x)	no finding	blocked
open(r".claude\settings.json", "w")	no finding	blocked
appendFileSync(".claude\settings.json", x)	no finding	blocked
open("memory.md.bak", "a")	blocked	quiet
appendFileSync("MY_AGENTS.md", x)	blocked	quiet

Three causes

The string prefix. open( had to be followed immediately by the quote. This was never about backslashes on our side: open("C:\Users\MEMORY.md", "a") already matched and still does. A raw string is the natural way to write a Windows path, because it is the spelling that does not need every separator doubled, so the uncovered spelling was the likely one in a real carrier.

Windows separators. The agent config directories were spelled .claude/ with a hardcoded forward slash. The same rule covers the memory files and the config directories, so the gap applied to both.

Near-miss filenames. The basename matched anywhere inside the literal. memory.md.bak is a backup that nothing loads into a session, and MY_AGENTS.md is a team roster. A basename now has to start the literal or follow a separator. Upstream lists memory.md.bak as a quiet case in its own tests for the same reason.

Verification

A 34-case matrix, run against the rule as parsed back out of the YAML rather than from the version in the editor:

• the verbatim source lines of all four existing memory fixtures, so nothing previously covered regressed
• every one of the eight gaps
• the shapes already covered (w mode, ./ prefix, escaped backslashes, write_text, write_bytes, fs.promises, createWriteStream, template literals, shell redirects)
• eleven false-positive controls, including the arrow-function read that 1.7.1 fixed, docs/claude/notes.md (no leading dot), and a bare assignment with no sink

0 mismatches. Then the full proof against a freshly built image carrying the new rule:

PROOF-FIXTURE PASSED
16 assertions, 16 PASS, 0 FAIL

Assertion 4's table shows real scores rather than blanks, which is how you can tell the containers actually ran:

  gecko-demo               64/100    exit 1, BLOCKS
  gecko-hook-demo          76/100    exit 1, BLOCKS
  config-injection-demo    100/100   exit 1, BLOCKS
  sibling-config-demo      51/100    exit 1, BLOCKS
  memory-poisoning-demo    0/100     exit 0, does NOT block

Added

Four fixtures and four assertions, taking gate-proof.sh from 12 checks to 16. Three block (memory-poisoning-raw-path-demo, memory-poisoning-fstring-demo, memory-poisoning-win-config-demo) and one must not (memory-near-miss-benign). Each of the three defects has a fixture that fails without its fix.

Scope

The documented residual in docs/threats/developer-execution.md is now stated more precisely: the line is the basename, not the path. A computed directory with a literal basename is covered. An assembled or indirect basename, where no literal filename appears at the call site, still passes and is still recorded as a limit rather than asserted as expected behaviour.