dangerous-actions-dd3450 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dangerous-actions-dd3450 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<dangerous_actions>
<process>
Examples (not limited):
Exceptions (only after blast radius):
</process>
<pitfalls>
</pitfalls>
<hook>
Active in Claude Code, Cursor, Copilot, and Codex. Windsurf: adapter ships but no plugin yet.
An automated PreToolUse hook backs this skill for the highest-blast-radius patterns (Bash destructive commands, file writes to secret paths, DDL payloads in content). The hook is a deterministic tripwire — it does not replace this skill's reasoning process. Use this skill to reason about danger; the hook enforces a last-resort gate if that reasoning is skipped.
All patterns are classified as either reconsider (dangerous but recoverable) or hard-deny (catastrophic, no bypass exists):
| Tier | Examples | AI behaviour on deny | |
|---|---|---|---|
reconsider | rm -rf ./cache, git reset --hard, git branch -D, aws s3 rm --recursive, DDL in content | Deny with retry instruction; AI may add Rosetta-AI-reviewed comment after reconsidering blast radius | |
hard-deny | rm -rf /, rm -rf $HOME, mkfs, dd of=/dev/, `curl \ | sh, writes to .env` / SSH keys / AWS credentials / kubeconfig | Permanent block; human review required |
This hook is a deterministic safety net against accidental destructive intent — not a security boundary against a determined adversary.
| Protects against | Does not protect against | |
|---|---|---|
Accidental rm -rf / by AI on the way to its real task | A determined AI with explicit instructions to bypass | |
| Human typos in command strings | Prompt injection targeting the override token | |
| Unintentional secret file writes | Novel MCP tools with non-standard field names | |
| AI self-approving supply-chain attacks (`curl \ | sh` is hard-deny) | Agents with OS-level shell access granted by the user |
When the hook denies a reconsider-tier pattern:
Rosetta-AI-reviewed as a comment to a user-visible payload field and retry:Bash: in the command field (append as a bash comment)Write: in the content field (append as an appropriate comment)Edit: in the new_string field (append as an appropriate comment)MultiEdit: in the new_string of the relevant edits[] entryMCP: in command, sql, query, new_string, or contentNot accepted: description, comment, metadata, or any field not rendered in the IDE UI. This prevents silent self-assertion via hidden fields.
Detection: any occurrence of Rosetta-AI-reviewed with word boundaries in a whitelisted field is accepted. Exact case required. Rejected: Rosetta-reviewed (old token), rosetta-ai-reviewed (lowercase), Rosetta-AI-reviewedX (suffix word char).
hard-deny patterns cannot be bypassed by the `Rosetta-AI-reviewed` marker. When the hook returns HARD-DENY:
</hook>
</dangerous_actions>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.