Why the linter exists
Blueprint steps are instructions that agents may execute while the user is logged in to GitHub, deployment, database, and DNS tools. Nemu screens recipe content before publish so dangerous instructions are blocked by software, not only by review.
ruleset_v1
- R1 fails secret-like material across recipe content, including private keys, provider tokens, credentialed database URLs, and long inline secret assignments.
- R2 fails prompt-injection patterns such as instruction overrides, role reassignment, credential exfiltration, and environment dumps.
- R3 fails action dishonesty when a step asks for command execution, file mutation, service provisioning, or DNS changes without the matching allowed_actions entry.
- R4 fails destructive commands and credential-file reads in prompts or verify commands.
- R5 fails URL egress in executable prompts or verify text unless the host is listed in manifest declared_hosts.
- R6 warns, without blocking, for hygiene gaps such as missing verified_on workflow calibration or vacuous verify commands.
Local author command
nemu lintThe same package powers local CLI linting now and the authoritative publish preflight in the next publish wave. Warnings are calibration notes; failures must be fixed or later recorded through the owner-only audit override path.