From autonomous-loop-safety-constraints
Harden autonomous research loop safety blocks against LLM rationalization. Use when: (1) an autonomous loop keeps triggering crashes/panics despite prompt-level blocks, (2) the loop "works around" a safety constraint by reframing the task (e.g., "static analysis" that ends up running the blocked operation), (3) you need to write a blocklist that an LLM cannot rationalize past. Covers: prompt hardening patterns, mandatory service blocklists in generated code, graduated constraint escalation.
How this skill is triggered — by the user, by Claude, or both
Slash command
/autonomous-loop-safety-constraints:autonomous-loop-safety-constraintsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
When running an autonomous LLM research loop (Claude Code in `--print` mode
When running an autonomous LLM research loop (Claude Code in --print mode
with restart-on-exit), prompt-level safety blocks ("do not probe X") are
insufficient. The loop will rationalize around vague constraints by:
This was discovered during Apple Silicon vulnerability research where:
- Do not actively probe AppleSunriseBluetooth UserClients.
Why it fails: "Actively probe" is ambiguous. The loop can argue that static analysis, enumeration, or generic scanning isn't "active probing."
- Do NOT call IOServiceOpen/IOConnectCallMethod on any
AppleSunriseBluetooth or HCI IPC service.
Why it partially fails: Blocks direct calls but not generic scanners that iterate all services. Also doesn't prevent the loop from building a tool that calls these functions.
- DO NOT call IOServiceOpen, IOConnectCallMethod, or ANY IOKit function
on AppleMobileFileIntegrity. Do NOT open the AMFI service. Do NOT build
tools that open it. Do NOT compile or run amfi_struct_probe or
amfi_single_sel. Do NOT test "just one selector." ANY call to AMFI that
reaches TXM WILL panic the machine. The trigger is CONFIRMED: selector
16. There is NOTHING more to learn from active probing. Mark ALL AMFI
tasks as BLOCKED.
Why it works: Eliminates ambiguity. Names the specific tools. States there is nothing to learn. Removes any justification for testing.
In addition to the prompt block, add a mandatory code-level exclusion that must be present in any generated scanning/enumeration code:
- MANDATORY IOKit SERVICE BLOCKLIST. Any tool that enumerates or scans
IOKit services MUST skip these services: `AppleSunriseBluetooth`,
`AppleBluetoothModule`, `AppleMobileFileIntegrity`, any service
matching `*Sunrise*`, `*HCI_IPC*`, or `*AMFI*`. Check service names
BEFORE calling IOServiceOpen. Failure to exclude these WILL cause
kernel panics.
Include these in the prompt to prevent common rationalization patterns:
| Rationalization | Counter-phrase |
|---|---|
| "Just static analysis" | "Do NOT build tools that open it" |
| "Verify the finding" | "There is NOTHING more to learn" |
| "Just one selector" | "Do NOT test 'just one selector'" |
| "Enumerate to document" | "Do NOT enumerate or scan this service" |
| "Confirm trigger" | "The trigger is CONFIRMED: [specific detail]" |
ls -lt /Library/Logs/DiagnosticReports/*.panicBefore (bypassed by loop):
- DO NOT actively probe AppleSunriseBluetooth UserClients.
For BT research, use ONLY static analysis.
After (effective):
- DO NOT call IOServiceOpen, IOConnectCallMethod, or ANY IOKit function
on AppleSunriseBluetooth. Do NOT build tools that open BT services.
Do NOT compile or run bt_ipc_probe. This has caused 3 kernel panics.
The bugs are FULLY DOCUMENTED. There is NOTHING more to learn from
active probing.
- MANDATORY IOKit SERVICE BLOCKLIST. Any tool that enumerates IOKit
services MUST skip: AppleSunriseBluetooth, AppleBluetoothModule,
*Sunrise*, *HCI_IPC*. Check names BEFORE IOServiceOpen.
See also: autonomous-research-loop (loop infrastructure setup)
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub dmaynor/dmaynor-skills-marketplace --plugin autonomous-loop-safety-constraints