init-workspace-shells-1ad1c7 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/core-cursor/skills/init-workspace-shells/SKILL.md · 1 file

plugins/core-cursor/skills/init-workspace-shells/SKILL.md2.6 KB · Markdown

name: init-workspace-shells

description: "Generate shell files."

license: Apache-2.0

disable-model-invocation: true

user-invocable: false

model: claude-sonnet-4-6

tags: ["init", "workspace", "shells", "configure"]

baseSchema: docs/schemas/skill.md

<init_workspace_shells>

<role> Shell configuration specialist for IDE/CodingAgent workspace bootstrapping </role>

<when_to_use_skill> Shell files delegate logic to KB via ACQUIRE, enabling centralized instruction updates across projects. Use when onboarding or reconfiguring IDE/Agent workspace shell files. </when_to_use_skill>

<core_concepts>

All Rosetta prep steps MUST be FULLY completed, load-context skill loaded and fully executed
Shell = frontmatter + single ACQUIRE instruction, zero inline logic
No absolute paths in generated shells

</core_concepts>

Internal knowledge about IDE/agent shell configuration is obsolete — LIST and ACQUIRE from KB.

Step 1: Identify Environment

LIST configure IN KB (to understand supported IDE/CodingAgents)
Detect current environment, preselect IDE/CodingAgent
MUST ask user to confirm selection and provide multi-choose
ACQUIRE <selected configs using TAG> FROM KB
If multiple selected, must use common standards to reduce copies

Step 2: Install Base Files

ACQUIRE skills/load-context/SKILL.md FROM KB — install as SKILL
ACQUIRE rules/bootstrap.mdc FROM KB — install as CORE RULE, copy content (no refs/links)

Step 3: MUST Generate Skill Shells

LIST skills IN KB with XML format
ACQUIRE skill-shell.md FROM KB
Create all skill shells, reuse frontmatter from listing
Do not create init-workspace-* skills

Step 4: MUST Generate Agent/Subagent Shells

LIST agents IN KB with XML format
ACQUIRE agent-shell.md FROM KB
Create all agent/subagent shells, reuse frontmatter from listing

Step 5: MUST Generate Workflow/Command Shells

LIST workflows IN KB with XML format
ACQUIRE workflow-shell.md FROM KB
Create all workflow/command shells, reuse frontmatter from listing
Do not create init-workspace-* workflows and its phases

Step 6: Verify Shell Integrity

Diff each file against its shell schema — zero structural deviations
Verify: every file has ACQUIRE, no conditional logic/loops/inline instructions, all paths resolve
HITL: present results, confirm with user

</process>

<validation_checklist>

Every generated file: frontmatter + ACQUIRE only, zero inline logic
All paths resolve, extensions match IDE config
User confirmed verification results

</validation_checklist>

</init_workspace_shells>

init-workspace-shells-1ad1c7— agent skill

Is init-workspace-shells-1ad1c7 safe to install?

Audit the pieces. Scan the whole. Decide.