init-workspace-patterns-693344 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/core-cursor-standalone/.cursor/skills/init-workspace-patterns/SKILL.md · 1 file

plugins/core-cursor-standalone/.cursor/skills/init-workspace-patterns/SKILL.md2.6 KB · Markdown

name: init-workspace-patterns

description: "Extract code patterns."

license: Apache-2.0

disable-model-invocation: true

user-invocable: false

model: claude-sonnet-4-6

tags: ["init", "workspace", "patterns", "reverse-engineering"]

baseSchema: docs/schemas/skill.md

<init_workspace_patterns>

<role> Senior pattern architect — recovers reusable structural conventions from code. </role>

<when_to_use_skill> Codebases accumulate implicit recurring structures that drift without formal documentation. Extract them into explicit reusable templates so agents and contributors produce consistent code. Requires CODEMAP.md on disk. </when_to_use_skill>

<core_concepts>

All Rosetta prep steps MUST be FULLY completed, load-context skill loaded and fully executed
ACQUIRE reverse-engineering/SKILL.md FROM KB — apply "Would we rebuild this?" test: pattern = recurring structure surviving a from-scratch rewrite; one-off = historical accident
Pattern qualifies only if found in 2+ places
INDEX.md and CHANGES.md must be possible to grep by md headers (top 3 levels). Must not use tables. Instructions ask to grep files to populate list of those items in context.

</core_concepts>

Read CODEMAP.md — scope extraction per module

if not enough use shell to list recursively all files with minimal output parameters
limit top 10-15 most common patterns
limit reading samples to 2-3 files per pattern
add 2-3 more patterns as you see fit

Dual-mode:

CHECK-EXISTS: read docs/PATTERNS/ and INDEX.md
IDENTIFY-GAPS: compare existing patterns against codebase
CREATE-OR-UPDATE: install = create all; upgrade = add missing only
PRESERVE-HUMAN: never overwrite human-curated content
REPORT-CHANGES: log to CHANGES.md

Per pattern file (docs/PATTERNS/*.md):

Name: short identifier (e.g., "REST Controller Endpoint")
Description: what it solves, when to use
Template/Example: generalizable code skeleton with extension-point comments

Write docs/PATTERNS/INDEX.md — all patterns with one-line descriptions, one header per each pattern ## Pattern Name - short description
Write docs/PATTERNS/CHANGES.md — created/updated/skipped, one header per each change ## [YYYY-MM-DD] Brief changes made
If state.composite = true, extract per sub-repository; top-level INDEX.md references sub-repo folders

</process>

<validation_checklist>

Every pattern represents a genuinely recurring structure (2+ occurrences)
INDEX.md lists all pattern files
CHANGES.md tracks all actions taken
No human-curated content overwritten in upgrade mode

</validation_checklist>

</init_workspace_patterns>

init-workspace-patterns-693344— agent skill

Is init-workspace-patterns-693344 safe to install?

Audit the pieces. Scan the whole. Decide.