sk-002: stellar-dev/smart-contracts/security.md:17 states self-reentrancy is

[kalepail]

Finding

stellar-dev/smart-contracts/security.md:17 states self-reentrancy is
"possible but rarely exploitable". This contradicts the host's actual
forbid-any-reentry behavior, and caused 1 baseline QA verdict in the
2026-07-03 round.

Evidence

2026-07-03 eval round results files above; the claim propagated into an agent
answer contradicted by host behavior.

Additional recorded evidence:

• eval/qa/results/2026-07-03T03-49-35-variantA.json
• eval/qa/results/2026-07-03T04-13-42-variantA.json
• caused 1 baseline QA verdict in the 2026-07-03 round
• upstream issue filed 2026-07-07: sk-002: stellar-dev/smart-contracts/security.md:17 states self-reentrancy is #46

Recommendation

Correct the statement in the upstream skill source, or qualify it precisely
against the host's forbid-any-reentry behavior. Do NOT patch the mirror in this
repo.

Source Record

This was found by the downstream Raven eval/improvements loop and recorded as sk-002 (skills, discovered 2026-07-03). Public record: https://github.com/kalepail/stellar-raven/blob/main/improvements/skills/sk-002-security-md-reentrancy-claim.md

[kalepail]

Verified fixed on 2026-07-09 against upstream commit c2f3c07 and the synchronized downstream mirror. The upstream file skills/smart-contracts/security.md now says the host blocks direct or indirect reentrant calls on normal cross-contract paths; the former “possible but rarely exploitable” sentence is absent. This is the source proof recorded in sk-002, so I’m closing the report as fixed.