load-context-acf2f5 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

instructions/r2/core/skills/load-context/SKILL.md · 1 file

instructions/r2/core/skills/load-context/SKILL.md1.7 KB · Markdown

name: load-context

description: "To load the most current project context; MUST during prep."

license: Apache-2.0

disable-model-invocation: false

user-invocable: false

baseSchema: docs/schemas/skill.md

Mode detection:

If RUNNING AS A PLUGIN is in context → Plugin mode
Else if get_context_instructions tool is available → MCP mode
Else → Adhoc mode

Plugin mode:

Bootstrap rules are loaded via startup hook — do NOT assume prep steps are done
Create todo tasks (search/discover the tool if needed)
Locate and execute ALL prep steps defined in the loaded bootstrap rules in full
DO NOT proceed to any action until all prep steps are confirmed complete
Identify and load the most matching workflow — a must if you are not subagent
Create and update all todo tasks per workflow

MCP mode:

Call get_context_instructions (blocking gate — do not proceed until complete)
If output truncated and file path provided — read entire file, preview is NOT enough
Create todo tasks (search/discover the tool if needed)
Execute ALL prep steps returned — no skipping, no partial execution
DO NOT proceed to any action until all prep steps are confirmed complete
Identify and load the most matching workflow — a must if you are not subagent
Create and update all todo tasks per workflow

Adhoc mode:

Read docs/CONTEXT.md and docs/ARCHITECTURE.md in full
List docs/*.md and workspace root *.md files to gather context

All modes:

Treat context loading as a hard blocking gate, not a background task
Explicitly confirm all prep steps complete before responding, planning, or executing anything
If anything fails or is unclear — stop and ask user

load-context-acf2f5— agent skill

Is load-context-acf2f5 safe to install?

Audit the pieces. Scan the whole. Decide.