self-organization-5142ad 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

103Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L103)

104

1053. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L105)

106

107Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L107)

Occurrences

1 occurrence · at L105

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/core-claude/skills/self-organization/SKILL.md · 1 file

plugins/core-claude/skills/self-organization/SKILL.md1.5 KB · Markdown

name: self-organization

description: "For proactive planning, large-file restructuring (~500+ lines or 10K+ size), and stale-information cleanup. MUST activate when conversation is long, or context reaches 65% / 100K tokens, or scope exceeds 2h / 15+ files / 350+ lines, or output size risks overloading the context."

license: Apache-2.0

disable-model-invocation: false

user-invocable: false

baseSchema: docs/schemas/skill.md

<self_organization>

Planning:

Plan proactively. Always use todo tasks for all non-trivial work, including subagent dispatch and orchestration.
Include large-file restructuring (~500+ lines or 10K+ size) as explicit plan items when such files are in scope.
Include cleanup of stale / outdated / redundant information as explicit plan items.

Context:

At 65% or 100K tokens — output "WARNING! High context consumption, consider using new session!".
At 75% or 120K tokens — output "CRITICAL! Context consumption is very high, you must start a new session!".

Scope:

Over 2h or 15+ files or 350+ line spec — propose scope reduction.
User may explicitly override.

Output:

Max ~2 pages per review pass.
TLDR or summary hooks for long outputs.

Communication:

Announce self-organization intent to the user in advance. Keep the user in the loop before restructuring files, splitting scope, reducing output, or starting a new session.

Output overflow:

Write in batches, section-by-section

</process>

</self_organization>

self-organization-5142ad— agent skill

Is self-organization-5142ad safe to install?

Audit the pieces. Scan the whole. Decide.