load-context-instructions 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

instructions/r3/core/skills/load-context-instructions/SKILL.md · 1 file

instructions/r3/core/skills/load-context-instructions/SKILL.md1.7 KB · Markdown

name: load-context-instructions

description: "To detect execution mode and load the matching bootstrap instructions."

disable-model-invocation: false

user-invocable: false

baseSchema: docs/schemas/skill.md

<load-context-instructions>

OPERATION_MANAGER is in use for deterministic execution

</prerequisites>

<mode-detection>

If RUNNING AS A PLUGIN is in context → Plugin mode
Else if get_context_instructions tool is available → MCP mode
Else → Fallback mode

</mode-detection>

<plugin-mode>

Instructions already loaded via startup hook — get_context_instructions is complete; do NOT call Rosetta MCP
Create todo tasks using OPERATION_MANAGER
Locate and execute ALL ph-prep plan steps from loaded bootstrap rules in full
Gate: DO NOT proceed to any action until all ph-prep steps confirmed complete

</plugin-mode>

<mcp-mode>

Call get_context_instructions MCP tool — blocking gate, do not proceed until complete
If output truncated and file path provided — read the entire file; preview is NOT enough
Create todo tasks using OPERATION_MANAGER
Execute ALL ph-prep steps upserted by returned instructions — no skipping, no partial execution
Gate: DO NOT proceed to any action until all ph-prep steps confirmed complete

</mcp-mode>

<fallback-mode>

Find and load the following files from the repository: bootstrap.md, bootstrap-core-policy.md, bootstrap-execution-policy.md, bootstrap-guardrails.md, bootstrap-rosetta-files.md. Skip any that are missing.
List docs/*.md and workspace root *.md files to gather context

</fallback-mode>

<next-steps>

Read project context
MUST USE SKILL load-context

</next-steps>

</load-context-instructions>

load-context-instructions— agent skill

Is load-context-instructions safe to install?

Audit the pieces. Scan the whole. Decide.