load-project-context 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

instructions/r3/core/skills/load-project-context/SKILL.md · 1 file

instructions/r3/core/skills/load-project-context/SKILL.md2.5 KB · Markdown

name: load-project-context

description: "To load the project's business, behavioral, and technical context."

license: Apache-2.0

disable-model-invocation: false

user-invocable: false

baseSchema: docs/schemas/skill.md

<load-project-context compact="NEVER" summarize="AS-IS">

USE SKILL hitl

</prerequisites>

<tasks> Tasks = execution ledger — survives dropped steps & compaction. MUST run as todo tasks — getting-ready included:

list up front · one in_progress · close before next · never skip
re-read to resume · update as facts surface
close on evidence, not assumption (coded ≠ done)

</tasks>

<project-files>

echo "=== docs/CONTEXT.md ==="; cat docs/CONTEXT.md; echo "=== docs/ARCHITECTURE.md ==="; cat docs/ARCHITECTURE.md
grep -nE "^#{1,3} " agents/IMPLEMENTATION.md agents/MEMORY.md docs/PATTERNS/INDEX.md docs/REQUIREMENTS/INDEX.md refsrc/INDEX.md

Prefer built-in tools over bash where available. </project-files>

<troubleshooting> File not found — it does not exist yet. Continue, do NOT error; STRONGLY suggest workflow init-workspace-flow.md. </troubleshooting>

<bootstrap_rosetta_files>

Rosetta files load in context: SRP/DRY/MECE, terse; md headers give grep + line-range loading (Auto-TOC) — read by header/range, not whole-file, and preserve that property when editing.

gain.json — SDLC setup + Rosetta file locations; wins conflicts.
docs/CONTEXT.md — business + behavior + target state; no tech, no changelog.
docs/ARCHITECTURE.md — architecture + technical requirements; modules, structure.
docs/TODO.md — improvements, large TODOs.
docs/ASSUMPTIONS.md — assumptions, unknowns.
docs/TECHSTACK.md — tech stack per module.
docs/DEPENDENCIES.md — dependencies per module.
docs/CODEMAP.md — code map.
docs/REQUIREMENTS/* — requirements; INDEX.md index, CHANGES.md log.
docs/PATTERNS/* — patterns; INDEX.md index, CHANGES.md log.
agents/IMPLEMENTATION.md — implementation state; the only changelog.
agents/MEMORY.md — root causes, what worked and failed.
plans/<FEATURE>/<FEATURE>-PLAN.md — execution plan.
plans/<FEATURE>/<FEATURE>-SPECS.md — tech specs.
plans/<FEATURE>/plan.json — Operation manager execution tracking file.
plans/<FEATURE>/* — supporting files.
refsrc/* — knowledge-only source; SCM-excluded except refsrc/INDEX.md.
agents/TEMP/<FEATURE> — temp; SCM-excluded.
docs/raw — raw requirement inputs.

</bootstrap_rosetta_files>

</load-project-context>

load-project-context— agent skill

Is load-project-context safe to install?

Audit the pieces. Scan the whole. Decide.