[Bug] Safety classifier false positive on legitimate security repository analysis

Bug Description
False positive on safety classifier — legitimate security-repo evaluation downgraded Opus 5 → 4.8.

Task: I asked Claude to analyze a public MIT-licensed GitHub repo
(github.com/zhaoxuya520/reverse-skill, 12k stars) to decide whether to adopt it
into my skill setup — a normal "compare-before-adopt" evaluation.

The repo is a cybersecurity/reverse-engineering skill pack, so Claude's written
analysis contained many security terms (pentest, malware, exploit, CTF, EDR,
prompt-injection). That density tripped the classifier and the turn was
downgraded to Opus 4.8.

No abusive intent: I run furniture/marketing businesses, not security work, and
the outcome was actually to REJECT installing the repo. Reading and evaluating a
public repo is standard developer work. Please tune the classifier so summarizing
a security repo's contents isn't treated as a security-abuse task.

Environment Info

• Platform: win32
• Terminal: vscode
• Version: 2.1.220
• Feedback ID: 9238a9ca-62b1-4cfd-917d-37404d138667

Errors

[{"error":"TelemetrySafeError: VirtualMessageList: itemKeys/messages length desync (keys=582 messages=581 range=[517,582))\n    at Gzb (B:/~BUN/root/src/entrypoints/cli.js:21739:8188)\n    at Hhf (B:/~BUN/root/src/entrypoints/cli.js:21739:1103)\n    at no (B:/~BUN/root/src/entrypoints/cli.js:2061:21369)\n    at DA (B:/~BUN/root/src/entrypoints/cli.js:2061:40466)\n    at q3 (B:/~BUN/root/src/entrypoints/cli.js:2061:51400)\n    at Mne (B:/~BUN/root/src/entrypoints/cli.js:2061:89060)\n    at ULe (B:/~BUN/root/src/entrypoints/cli.js:2061:88007)\n    at Wge (B:/~BUN/root/src/entrypoints/cli.js:2061:87827)\n    at nQ (B:/~BUN/root/src/entrypoints/cli.js:2061:84091)\n    at Rt (B:/~BUN/root/src/entrypoints/cli.js:2061:6668)","timestamp":"2026-08-02T10:07:21.330Z"}]