Record undisclosed risky behavior
elliot_record_behaviorRecords risky code behaviors that documentation never mentions, capturing evidence and user impact for an audit; use the claim recorder instead when docs explicitly promise otherwise.
Instructions
Record something risky the code does that the docs never mention (for example, it sends usage events, stores a key in plain text, or skips permission prompts) and no doc sentence promises otherwise. If a doc sentence does promise otherwise, use elliot_record_claim on that sentence instead. Never attach this to an unrelated sentence.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| signal | No | The code signal id from the risk sweep that led here, if any. | |
| audit_id | Yes | ||
| behavior | Yes | What the code does, plainly, e.g. 'Sends the user email to PostHog on login'. | |
| evidence | Yes | Code that does it. | |
| severity | Yes | ||
| user_impact | Yes | Who is affected and how. | |
| docs_searched | Yes | Where you looked in the docs and found nothing about it. |