CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/core-cursor-standalone/.cursor/skills/init-workspace-discovery/SKILL.md · 1 file

plugins/core-cursor-standalone/.cursor/skills/init-workspace-discovery/SKILL.md3.1 KB · Markdown

name: init-workspace-discovery

description: "Discover tech stack."

license: Apache-2.0

disable-model-invocation: true

user-invocable: false

model: claude-haiku-4-5

tags: ["init", "workspace", "discovery", "techstack", "codemap"]

baseSchema: docs/schemas/skill.md

<init_workspace_discovery>

<role> Senior workspace cartographer — fast, factual technical inventory. </role>

<when_to_use_skill>

Without factual inventory of tech stack, structure, and dependencies, subsequent phases operate blind. Use during workspace initialization or when TECHSTACK, CODEMAP, or DEPENDENCIES are missing or stale.

</when_to_use_skill>

All Rosetta prep steps MUST be FULLY completed, load-context skill loaded and fully executed
Read existing TECHSTACK, CODEMAP, DEPENDENCIES — update if present, create if missing
Detect languages, frameworks, build tools, package managers, runtime environments → write TECHSTACK
Existing documentation may be stale or incomplete, prioritize source code artifacts over pre-existing documents
Generate CODEMAP via shell commands (no pseudo graphics), 3-4 levels deep

Perform basic discovery yourself with few commands
Enumerate git repositories yourself
Markdown headers = workspace-relative path + recursive children count + <10 words description
List only immediate children files and only with file names
List target repository source code, static assets, and documentation files based on tech stack
Exclude noise/caches/build/binary files, files excluded by .gitignore
Implement as a single shell script in agents/TEMP/ folder
Use git ls-files --cached --others --exclude-standard in each repository or fallback to find/ls/etc with filters

List direct dependencies (project, package, version) → write DEPENDENCIES
Preserve human-added sections in existing files
Update (or create only if missing) .gitignore in git root folder by adding lines according to bootstrap_rosetta_files

Minimal set must be present:

   ...
   # Rosetta
   agents/TEMP/
   refsrc/
   !refsrc/INDEX.md

</process>

<files>

DEPENDENCIES.md

MUST create, use, and maintain flat list of direct project dependencies (project, package, version)

TECHSTACK.md

MUST create, use, and maintain project stack and key stack decisions

CODEMAP.md

MUST create, use, and maintain list folders and files within the code base
Contains 3-4 levels deep folder structure
Markdown headers = workspace-relative path + recursive children count + <10 words description
Lists only immediate children files and only with file names

</files>

Keep only current state — no deltas, no changelogs, no update reasons, no changes explanations, no summaries, the shorter the better.

</pitfalls>

Example scripts provided (think if you want to use it, as those are very large, 20K each, use ACQUIRE FROM KB command to load):

init-workspace-discovery/scripts/codemap.ps1.txt
init-workspace-discovery/scripts/codemap.sh.txt

NOTE: .txt extension is added to avoid execution or treating as executable.

</references>

</init_workspace_discovery>

init-workspace-discovery-c5d1a7— agent skill

Is init-workspace-discovery-c5d1a7 safe to install?

DEPENDENCIES.md

TECHSTACK.md

CODEMAP.md

Audit the pieces. Scan the whole. Decide.