CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

18.2 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 4 flagged

Securityscore 52 · 4 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · engineering/grill-me/skills/grill-me/references/forcing_question_patterns.md×4

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptengineering/grill-me/skills/grill-me/references/forcing_question_patterns.md· markdown

101| Question | Action |

102|---|---|

103| "What auth library are we using?" | `grep -r "auth" package.json` — don't ask |

104| "Does X already exist?" | `find . -name "X*"` — don't ask |

105| "What's the current schema?" | `Read path/to/migrations/latest.sql` — don't ask |

Occurrences

4 occurrences · first at L103, also L104, L105 +1 more

Show all 4 locations

Line

File

L103

engineering/grill-me/skills/grill-me/references/forcing_question_patterns.md

L104

engineering/grill-me/skills/grill-me/references/forcing_question_patterns.md

L105

engineering/grill-me/skills/grill-me/references/forcing_question_patterns.md

L106

engineering/grill-me/skills/grill-me/references/forcing_question_patterns.md

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256ce5204b52388d24f…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

engineering/grill-me/skills/grill-me/SKILL.md · 1 file

engineering/grill-me/skills/grill-me/SKILL.md2.5 KB · Markdown

name: grill-me

description: Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

license: MIT

metadata:

derived_from: "https://github.com/mattpocock/skills/tree/main/skills/productivity/grill-me"

original_author: "Matt Pocock (@mattpocock)"

original_license: MIT

voice: "Matt Pocock — relentless, one-at-a-time, explores-codebase-first"

version: 1.0.0

Grill Me

Derived from Matt Pocock's grill-me (MIT). Matt's interview discipline preserved verbatim. Additions: extraction + question + session tools + references + cs-* wrapper (see references/companion_tooling.md).

Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.

Ask the questions one at a time.

If a question can be answered by exploring the codebase, explore the codebase instead.

Rules (preserved + amplified)

One question per turn. Never bundle.
Provide a recommended answer with each question. Defaulting to "what do you think?" is lazy.
Explore the codebase before asking. If grep / Read resolves it, do that first. Saves a turn.
Walk the tree depth-first. Finish a branch before opening another.
Track dependencies. If decision B depends on decision A, ask A first.

Workflow

User provides a plan or design (or path to one).
Run scripts/decision_tree_extractor.py to extract branches.
Run scripts/question_generator.py to produce the question list with recommendations.
Start a session: scripts/grill_session_tracker.py --action start.
Walk the tree, one question at a time, recording answers in the session.
When all branches resolved: report "shared understanding reached" + the locked-in decisions.

Output Pattern

Per question turn:

Q[i]/[total]: [question]
Recommended answer: [your call + 1-sentence rationale]

(Or: I explored the codebase and found [evidence]. Confirm?)

Tooling

See references/companion_tooling.md. Tools: extractor + generator + tracker. Agent: cs-grill-master. Command: /cs:grill-me.

Version: 1.0.0 Derived: Matt Pocock (MIT) + this repo's wrapper

grill-me— agent skill

Is grill-me safe to install?

Grill Me

Rules (preserved + amplified)

Workflow

Output Pattern

Tooling

Audit the pieces. Scan the whole. Decide.