CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

17.5 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 2 flagged

Securityscore 50 · 2 findings

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.en.md

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted

excerptREADME.en.md· markdown

2<a href="https://linux.do/t/topic/2108966/20" alt="LINUX DO">

3<img

4src="https://img.shields.io/badge/LINUX-DO-FFB003.svg?logo=data:image/svg%2bxml;base64,DQo8c

… (96 chars elided on L4)

5<a href="https://dev.to/_879c5a0279451d52e43c3/aegis-a-method-pack-for-more-reliable-ai-codi

… (29 chars elided on L5)

6<img src="https://img.shields.io/badge/DEV.to-Article-0A0A0A?logo=devdotto&logoColor=white"

… (6 chars elided on L6)

Occurrences

1 occurrence · at L4

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha25631792e4fb4063c27…rubric 365aacaView on GitHub

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.md

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

The exact value spotted

excerptREADME.md· markdown

2<a href="https://linux.do/t/topic/2108966/20" alt="LINUX DO">

3<img

4src="https://img.shields.io/badge/LINUX-DO-FFB003.svg?logo=data:image/svg%2bxml;base64,DQo8c

… (96 chars elided on L4)

5<a href="https://dev.to/_879c5a0279451d52e43c3/aegis-a-method-pack-for-more-reliable-ai-codi

… (29 chars elided on L5)

6<img src="https://img.shields.io/badge/DEV.to-Article-0A0A0A?logo=devdotto&logoColor=white"

… (6 chars elided on L6)

Occurrences

1 occurrence · at L4

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha25631792e4fb4063c27…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/recording-architecture-decisions/SKILL.md · 1 file

skills/recording-architecture-decisions/SKILL.md5.4 KB · Markdown

name: recording-architecture-decisions

description: Use when the user asks to create, write, update, amend, supersede, or evaluate an ADR, architecture decision record, durable architecture decision, decision log, or baseline sync after architecture-changing work.

Recording Architecture Decisions

Purpose

Record durable architecture decisions without losing the current-state baseline closure. An ADR records why a decision was made; a baseline records what the architecture is after that decision.

This skill is a lazy, task-specific workflow. It does not replace verification-before-completion, does not grant completion authority, and does not make authoritative GateDecision or PolicySnapshot outputs.

Required Read Set

Before deciding or writing, read the smallest relevant excerpts from:

docs/adr/ADR-CREATION-GATE.md
docs/current/AEGIS_ADR_AUTO_BACKFILL.md
the target project's current ADR, baseline, or authority docs that own the

affected architecture surface

For Aegis repository changes, use this repository's docs/adr/ and docs/current/ authority order. For target projects with their own ADR system, respect that project owner instead of duplicating the same decision into docs/aegis/adr/.

When To Use

Use this skill when the user asks to:

create, write, update, amend, supersede, or evaluate an ADR
decide whether an architecture decision record is needed
record a durable architecture decision or decision log entry
close baseline sync after an ADR-relevant architecture change
verify that an ADR action did not leave the architecture baseline stale

Do not use it for simple wording edits, ordinary README cleanup, tests-only coverage improvements, low-risk single-file changes, or bug fixes that only restore the existing baseline.

Decision Flow

Identify the decision candidate and evidence source.
Run the ADR creation gate:

hard to reverse
surprising without context
real trade-off

Apply the Retro / Memory Filter:

executed durable decisions may become ADR or baseline memory
unexecuted ideas stay out of accepted architecture memory
process notes may use a lighter record when they do not change current

architecture state

Choose exactly one ADR action: create, amend, supersede, or skip.
Choose the owner surface: project docs/adr/, docs/aegis/adr/, existing

ADR, or lighter record.

Run Baseline Sync Closure.
If writing files, preserve local ADR conventions and verify structure.

Helper-Backed Write Path

When the chosen owner surface is a target project's docs/aegis/adr/, use the shared workspace helper instead of ad-hoc file creation:

create -> <aegis-workspace-helper> new-adr --root <target-project-root> ...
amend -> <aegis-workspace-helper> amend-adr --root <target-project-root> --path docs/aegis/adr/ADR-####-<slug>.md ...
supersede -> <aegis-workspace-helper> supersede-adr --root <target-project-root> --path docs/aegis/adr/ADR-####-<slug>.md ...

After helper-backed writeback, run:

<aegis-workspace-helper> check --root <target-project-root>

The helper owns file shape, ADR numbering, supersession markers, and INDEX.md coverage only. It does not decide architecture truth, whether the ADR gate passed, or whether baseline sync is semantically sufficient.

If the ADR gate or owner-surface decision says skip, do not create or amend ADR files just because the helper exists.

Baseline Sync Closure

If the ADR action is create, amend, or supersede, baseline sync must be checked.

Baseline sync is required when the decision changes or confirms any of:

canonical owner or ownership map
public API, schema, artifact shape, or behavior contract
dependency direction or allowed cross-module relationship
source-of-truth owner
host compatibility strategy or install/discovery contract
method-pack/runtime-core boundary
runtime-ready artifact boundary or evidence model
retained fallback, adapter, compatibility path, duplicate owner, or retirement

schedule

accepted architecture-scoped Implementation Drift
release or distribution strategy that future contributors would otherwise

misread

If no baseline writeback is made, state why the existing baseline remains valid. Never leave baseline sync implicit after create, amend, or supersede.

Compact Output Contract

Decision Candidate:
- Summary:
- Evidence source:

ADR Gate:
- Hard to reverse: yes | no | unknown
- Surprising without context: yes | no | unknown
- Real trade-off: yes | no | unknown

Retro / Memory Filter:
- Classification: executed durable decision | unexecuted idea | process note
- Memory action: record | skip | lighter record
- Reason:

ADR Action:
- create | amend | supersede | skip
- Reason:

Owner Surface:
- Target:
- Existing ADR / baseline checked:

Baseline Sync:
- Required: yes | no | unknown
- Target:
- Action: create snapshot | update baseline | cite unchanged | blocked
- Reason:

Boundary:
- Advisory method-pack signal only; not completion authority.

Common Mistakes

Writing an ADR because the topic feels important, even though the gate fails.
Recording why in an ADR while leaving the baseline's current-state facts stale.
Updating a baseline to match drift without first deciding whether the drift is

intentional and ADR-worthy.

Duplicating the same decision into both project docs/adr/ and

docs/aegis/adr/ without an explicit mirror relationship.

Treating an ADR or baseline sync as proof that the work is complete.

recording-architecture-decisions— agent skill

Is recording-architecture-decisions safe to install?

Recording Architecture Decisions

Purpose

Required Read Set

When To Use

Decision Flow

Helper-Backed Write Path

Baseline Sync Closure

Compact Output Contract

Common Mistakes

Audit the pieces. Scan the whole. Decide.