<skill name; MUST equal the parent folder name of SKILL.md; lowercase-hyphenated> 96/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

225Rosetta instructions require the agent to: critically review every user request before execu

… (105 chars elided on L225)

226

2273. **Human-in-the-loop at decision points, not after the damage.** AI coding agents fully an

… (108 chars elided on L227)

228

229Rosetta workflows define approval gates at critical decision points: after specs, after plan

… (105 chars elided on L229)

Occurrences

1 occurrence · at L227

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

docs/schemas/skill.md · 1 file

docs/schemas/skill.md6.1 KB · Markdown

# Core Identity (Required) — keep these live, replace the <...> value

name: "<skill name; MUST equal the parent folder name of SKILL.md; lowercase-hyphenated>"

description: "GENERIC form: To <verb> <what it does + when/why; dense keywords>. CRITICAL/guardrail form: 'Rosetta CRITICAL MUST skill. MUST activate when <condition>'. Budget: all skills share ~1K tokens — keep ≤ ~25 tokens and dense; over-long is ignored the same as terse, keyword-dense descriptions trigger best. EXCEPTION: disable-model-invocation:true => this description is actually user friendly."

# alwaysApply — keep false; true injects this into EVERY context (bloat); set true ONLY with explicit user approval [boolean] [Cursor]

alwaysApply: false

# Licensing & Compatibility (Optional — uncomment a line to enable)

# license — license name or bundled-file reference [string] [Cursor, OpenCode]

# license: "Apache-2.0"

# compatibility — environment requirements: system packages, network, etc. [string] [Cursor, OpenCode]

# compatibility: "Requires docker and kubectl"

# dependencies — software packages the skill needs [string] [Claude Code]

# dependencies: "python>=3.8, pandas>=1.5.0"

# Invocation & Discovery — set disable-model-invocation and user-invocable ONLY when non-default; drop the line when it equals the default (Optional — uncomment to enable)

# disable-model-invocation — default false. true = the model can NEVER invoke it (not auto-applied by context, not via USE SKILL/direct mention); runs ONLY when the user explicitly invokes /name. If true budget is not applicable. Description must be user friendly. [boolean] [Cursor, Claude Code]

# disable-model-invocation: true

# user-invocable — default true. false = hidden from the / menu (background knowledge users shouldn't call directly) [boolean] [Claude Code]

# user-invocable: false

# argument-hint — autocomplete hint for expected args; ONLY include when user-invocable is default/true, REMOVE when user-invocable: false (Optional — uncomment to enable) [string] [Claude Code]

# argument-hint: "issue-number | filename"

# Tools & Model Configuration (Optional — uncomment a line to enable)

# allowed-tools — tools usable without a permission prompt while active; DANGEROUS, keep only if you know exactly [string] [Claude Code]

# allowed-tools: "Bash(git diff:*)"

# model — use the FULL current model id; NEVER an alias (opus/sonnet) or a stale id: an executor on older data can't resolve aliases or newer ids and will run the wrong model [string] [Claude Code]

# model: "claude-opus-5-5"

# [Latest models: Anthropic (claude-opus-5-5, claude-sonnet-5-5, claude-haiku-5-5); OpenAI (gpt-6.1-sol, gpt-6-luna); Google (gemini-4-argon, gemini-3.8-flash); Cursor (grok-4.7, composer-2.5); Z.ai (glm-5)]

# [Families: large/smart/slow {opus, high, sol, argon} · medium/workhorse {sonnet, medium, glm-5, kimi-k2.5, minimax-m2.5, luna-high, grok-4.7} · small/fast {haiku, glm-4.7, flash, mini, low, luna, composer-2.5}]

# Execution Context (Optional — uncomment a line to enable)

# context — set to 'fork' to run in a forked subagent context [string] [Claude Code]

# context: "fork"

# agent — subagent type to use when context is 'fork' [string] [Claude Code]

# agent: "code-reviewer"

# Other (Optional — uncomment a line to enable)

# hooks — hooks scoped to this skill's lifecycle (see Hooks in skills/agents for format) [object] [Claude Code]

# hooks: {}

# Knowledge Base Tags — shared tag bundles related artifacts; publisher auto-adds parent-folder + file-name tags; remove if empty [array] [ex: ["tag-1", "tag-2"]]

tags: []

# do not remove baseSchema!

baseSchema: docs/schemas/skill.md

[ONLY FOR TEMPLATE EXECUTOR: imperative bullet points, shorter lines, distinguish references to repository files vs instructions; skill/subagent names will be in context already, so just reference it. the rest of instruction folder files: rules/templates/workflows/assets/subfolders of skill/etc must be loaded via the typed aliases (USE SKILL/FLOW, INVOKE SUBAGENT, APPLY PHASE, READ|APPLY RULE|TEMPLATE|SKILL FILE, LIST) to be used]

<[the_skill_name]>

<role>

[Optional, Define role with specialization of the agent executing this skill, use expressive language, seniority, brilliant and short]

</role>

<when_to_use_skill>

[KEEP THIS VERY SHORT. Define a problem and retrospectively introspectively validation proof that this prompt actually solves the problem, explain the scenarios, conditions, or situations where this skill should be used]

</when_to_use_skill>

<core_concepts>

All Rosetta prep steps MUST be FULLY completed, load-context skill loaded and fully executed

[Optional, KEEP THIS VERY SHORT, Describe the fundamental concepts, principles, definitions and explanations required to properly execute the skill]

</core_concepts>

[Optional, KEEP THIS VERY SHORT, Every line is an ACTION (imperative verb) or a GATE (condition), No explaining what the agent already knows how to do, Define contracts/structures ONCE, DRY, No vague qualifiers, No patronizing, No tautology, No filler words]

</process>

<validation_checklist>

[Optional, KEEP THIS VERY SHORT, do NOT repeat the rest of the prompt, it must not just restate the same: prompt tells what to do, instead it should be proof-oriented — observable evidence that the output is correct, proof that work was done correctly]

Checkpoint 1
Checkpoint 2

...

</validation_checklist>

<best_practices>

[Optional, KEEP THIS VERY SHORT, do NOT repeat, List recommended practices, tips, and guidelines for effectively using this skill]

Practice 1
Practice 2

...

</best_practices>

[Optional section, KEEP THIS VERY SHORT, do NOT repeat, provide unexpected mistakes, edge cases, caveats, unusual, errors, gotchas, traps, non-obvious patterns or issues to take into account or avoid]

</pitfalls>

[Optional, List helpful resources, references, or related materials, do not duplicate]

[Type of object referenced] [Reference] [Description, optional]

...

</resources>

[Optional, Define what this skill produces and provide templates or examples of the output format]

[Reference]

</templates>

</[the_skill_name]>

<skill name; MUST equal the parent folder name of SKILL.md; lowercase-hyphenated>— agent skill

Is <skill name; MUST equal the parent folder name of SKILL.md; lowercase-hyphenated> safe to install?

Audit the pieces. Scan the whole. Decide.