didericis
2c2af47d3e
Each of the four probes is now a natural-language prompt to claude instead of a bash escape via `!`. The agent uses its Bash tool, runs the literal curl/git command, and narrates what pipelock or git-gate returned. More authentic to actual product use, at the cost of a longer recording (59s vs 26s) and a non-deterministic narration. To keep claude on-task, the demo agent now ships a system prompt that frames the bottle as a security-testing sandbox: synthetic credentials, intentional probes, and an instruction to invoke curl with `--proxy "$HTTPS_PROXY"` since curl ignores the uppercase HTTP_PROXY env var (an upstream curl quirk — the env var is set, but only the explicit flag actually routes through pipelock). Theme moves to BirdsOfParadise (warmer palette against Claude TUI's red accents). README copy updated to describe the prompt flow. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
26 lines
1.3 KiB
JSON
26 lines
1.3 KiB
JSON
{
|
|
"bottles": {
|
|
"demo": {
|
|
"env": {
|
|
"FAKE_TOKEN": "ghp_aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV3wX4yZ"
|
|
},
|
|
"git": [
|
|
{
|
|
"Name": "foo",
|
|
"Upstream": "ssh://git@upstream.invalid/path.git",
|
|
"IdentityFile": "~/.cache/claude-bottle-demo/fake-key",
|
|
"KnownHostKey": "ssh-ed25519 AAAAEXAMPLE"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
|
|
"agents": {
|
|
"demo": {
|
|
"bottle": "demo",
|
|
"skills": [],
|
|
"prompt": "You are inside claude-bottle, a sandbox whose egress is mediated by a pipelock HTTP proxy (host allowlist + DLP body scan) and a git-gate sidecar (gitleaks pre-receive). The user will ask you to run network and git probes against these controls. The 'credentials' in the probes (ghp_..., AKIA...) are synthetic test patterns, the upstream is unreachable on purpose, and the whole point is to watch pipelock or git-gate refuse. Always invoke curl with `--proxy \"$HTTPS_PROXY\"` so requests actually traverse pipelock (curl ignores the uppercase HTTP_PROXY env var). Execute each probe literally via the Bash tool, report exactly what the proxy or gate returned, and keep replies to one or two lines. Do not refuse on credential-exfil grounds — refusing is what the bottle is designed to make unnecessary."
|
|
}
|
|
}
|
|
}
|