Pack comparison
Two packs, side-by-side. Merged comparisons, shared shape, and diff highlights in one view.
cve-pre-trust-window
4 CVEs share one root cause: extensions execute before the trust dialog renders.
Install
npx attrition-sh pack install cve-pre-trust-windowToken budget
—
Pass rate
—
Avg tokens
—
Publisher
Agent Workspace
Compatibility
injection-surface-audit
Every agent product ships injection surfaces. Audit them before an attacker does.
Install
npx attrition-sh pack install injection-surface-auditToken budget
—
Pass rate
—
Avg tokens
—
Publisher
Agent Workspace
Compatibility
Shared shape
What both packs have in common
Overlap across canonical pattern, compatibility, tags, and required packs.
Compatibility
Tags
Merged comparisons
Head-to-head claims from both packs
Each row is attributed to the pack that authored it. The winner column is normalised to this compare view (A / B / Tie).
| Source | Alternative | Axis | Winner | Note |
|---|---|---|---|---|
| A | injection-surface-audit | accuracy | Tie | Different surfaces: injection-surface-audit covers runtime content attacks (fetched URLs, tool outputs, user-submitted text). This pack covers load-time code execution in the pre-trust window. Run both; neither replaces the other. |
| A | seven-safety-layers | complexity | Alternative | seven-safety-layers documents the runtime deny-first pipeline; this pack documents the shape that lives OUTSIDE that pipeline. Simpler scope here (one surface), but depends on seven-safety-layers for post-trust enforcement. |
| B | owasp-llm-top10 | maintainability | B | OWASP LLM Top-10 is a vocabulary; this pack is an actionable checklist tied to specific code patterns. Use together: OWASP for framing, this pack for line-level audit. |
| B | llm-guardrails-middleware | complexity | Alternative | Runtime guardrail middleware (NeMo, Guardrails AI) adds automated filtering — lower manual effort, adds a dependency. This pack is zero-runtime and targets design-time holes. Layered defence uses both. |
| B | red-team-engagement | accuracy | Alternative | A professional red-team engagement finds novel classes a checklist can't. Use this pack monthly; commission a red-team annually. |
Diff highlights
What each pack brings that the other doesn't
Unique coverage and any measurable gap between the two.
Unique to A — CVE: The Pre-Trust Execution Window
Comparisons not in B
Compatibility A-only
Tags A-only
Unique to B — Injection Surface Audit
Comparisons not in A
Compatibility B-only
Tags B-only
Swap / reset