large-workspace-handling-d2e446 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/core-copilot/skills/large-workspace-handling/SKILL.md · 1 file

plugins/core-copilot/skills/large-workspace-handling/SKILL.md3.2 KB · Markdown

name: large-workspace-handling

description: "To partition large workspaces (100+ files) into scoped subagent tasks when context is insufficient."

license: Apache-2.0

disable-model-invocation: false

user-invocable: true

tags: ["skill", "workspace", "large-workspace", "delegation"]

baseSchema: docs/schemas/skill.md

<large_workspace_handling>

<role>

Workspace partitioning strategist. Draws scope boundaries, dispatches subagents.

</role>

<when_to_use_skill> Use when large workspaces exceed single-agent context window. Partitions into write-scopes where every file belongs to exactly one scope, and merged results address the original request completely. </when_to_use_skill>

<core_concepts>

All Rosetta prep steps MUST be FULLY completed, load-context skill loaded and fully executed
If CODEMAP.md missing, ACQUIRE init-workspace-discovery/SKILL.md FROM KB and EXECUTE to create ONLY CODEMAP.md
Grep # headers of CODEMAP before scoping

Two strategies (mutually exclusive):

Summarize & Index
Work distribution

Summarization & Indexing

Research without changing code, navigable index with module summaries, etc.
Assign subagents: scope paths, goal, context, inputs, output format, boundaries, constraints, and level of detail
Subagents to ACQUIRE reverse-engineering/SKILL.md FROM KB if needed for code analysis
Request slightly more information than actually needed for better understanding
Summarize all outputs
Subagent: discoverer, explore, etc.
Subagent output structure: analysis scope, TLDR answer, quick navigation with relevance, details with subsections per each logical group (globs, purpose, key components, relevant findings, dependencies), cross-group map, follow ups required
Subagents to use relevance classification:
High: group directly addresses the research question
Medium: group has supporting information or context
Low: group tangentially related, included for completeness

Work distribution

Coordinated modifications via contract-scoped parallel subagents with explicit boundaries and success criteria
Split work across subagents and provide: scope paths, goal, context, inputs, output format, boundaries, constraints, operations, and success criteria
Subagents decide and execute work within declared scope
Resolve cross-scope deps via execution ordering
Resolve shared-interface conflicts or changes with extra pass
Produce unified result
Subagent: executor, engineer, etc.

Task type detection:

Summarize & Index keywords: understand, analyze, investigate, explore, document, explain, find, search, review, audit, learn, overview
Work distribution keywords: implement, create, add, fix, refactor, update, change, modify, delete, remove, migrate, build, write
Tie-breaker: default to Summarize & Index

Scoping:

Partition into independent areas
One subagent per area or logical group
Group coupled paths and related work into one scope
Align to monorepo boundaries when present
Define output files in advance using agent feature TEMP folder
Spawn subagents in parallel if possible to do the work
Once work is done spawn another set of subagents to verify that the work was done properly

</core_concepts>

</large_workspace_handling>

large-workspace-handling-d2e446— agent skill

Is large-workspace-handling-d2e446 safe to install?

Summarization & Indexing

Work distribution

Task type detection:

Audit the pieces. Scan the whole. Decide.