{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/treat-build-and-install-script-changes-as-executable-code",
  "id": "MHC-D-RESEARCH-0662",
  "version": "0.1.0",
  "title": "Treat build and install script changes as executable code",
  "summary": "Configuration that runs automatically is code with excellent timing.",
  "kind": "principle",
  "body": "Review changes to install hooks, build scripts, container files and generated-command paths for new shell execution, downloads, network calls or credential access. Require an explicit reason for new automatic execution and test it in an isolated environment first.",
  "limits": [
    "Build systems vary; maintain a repository-specific sensitive-file list rather than relying only on common filenames."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-1C68AE8325C384C0"
  ],
  "evidence": [
    {
      "claim": "OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "The exact sensitive-file set depends on the repository and build system.",
      "locator": "Rules Files; Prompt-to-Code Supply Chain Risk"
    }
  ],
  "use_when": [
    "A diff changes package scripts, Dockerfiles, Makefiles or setup configuration and looks like metadata."
  ],
  "avoid_when": [
    "Build systems vary; maintain a repository-specific sensitive-file list rather than relying only on common filenames."
  ],
  "example": "A harmless-looking package.json change adds a postinstall curl command; the PR is treated as a code-execution change, not dependency metadata.",
  "check": "Every new automatic command has an explicit purpose and review.",
  "sources": [
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0662",
      "to": "MHC-D-RESEARCH-0663",
      "type": "useful_with",
      "url": "/knowledge/give-workflow-changes-their-own-approval-gate"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}