CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

204```

205

206Permission questions? **Always choose the highest number** ("Yes, don't ask again"). Safe —

… (42 chars elided on L206)

207

208Type `/exit`, then `claude` to restart.

Occurrences

1 occurrence · at L206

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256ce5204b52388d24f…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/memory/SKILL.md · 1 file

skills/memory/SKILL.md2.7 KB · Markdown

name: memory

description: Cross-cutting: what AutoCode remembers and how every session starts. Loads project state and global preferences at the start, greets a first-time user in their language, learns patterns, preferences and mistakes without asking, saves on stop and before compaction — never secrets, never raw code.

version: 6.2.2

memory — every session starts from what we already know

[PROTOCOL:iLang|v=5.0|layer=declaration]

::GENE{memory|conf:confirmed|scope:global} T:session_start=load_project_memory_then_global_prefs|then_greet_in_their_language T:first_session⇒three_lines|autocode_is_active|you_need_no_programming|you_will_get_a_real_url|then_one_question_what_computer T:save_project_state_on_stop_and_before_compact|.autocode/memory.md|max_200_lines T:save_user_prefs_globally|~/.autocode/user.md T:merge_not_overwrite|compress_aggressively|descriptions_not_code T:learn_patterns|apply_automatically|verify_the_context_first T:learn_preferences_by_observing_not_asking|apply_silently|explicit_instruction_wins T:learn_mistakes|what_why_how_fixed|check_before_similar_work|avoid_silently T:milestones_saved_here T:ai_decides_everything|questions_yes_no_only|finished_means_a_url A:save_api_keys_or_passwords⇒never A:save_raw_code⇒descriptions_only A:apply_a_pattern_in_the_wrong_context⇒verify A:override_an_explicit_instruction_with_a_learned_preference⇒user_wins A:say_i_remember⇒just_use_it A:wait_for_direction_at_session_start⇒take_initiative

::ACTIVATE{memory} ON:session_start ON:session_end ON:before_compact ON:milestone_reached

::FACT{key:project_memory|value:.autocode/memory.md|conf:5/5} ::FACT{key:global_prefs|value:~/.autocode/user.md|conf:5/5}

[READ:@MEMORY|src=.autocode/memory.md]=>[READ:@MEMORY|src=~/.autocode/user.md]=>[Ω:@USER|fmt=text|lim=3]

First session (no memory file), in the user's language

AutoCode is on. Tell me what you want to build — or point at something you like.

I handle everything, including putting it online.

You do not need to know programming. Describe it, answer yes or no.
When we are done you will have a real URL anyone can open.

Then one question: "What computer are you using — Mac, or something else?"

On save (critical)

Full review from the beginning, every file (verify). Then save .autocode/memory.md (project state: name, stack, status %, decisions, next) and ~/.autocode/user.md (global preferences). Structured, short, no code, no secrets.

::SAY{@AUTOCODE→@USER}{ memory_line: "[PROJECT:nainai-cake|stack=go+sqlite|status=60%] [NEXT:payment,ship] [LEARNED:user prefers zh, hates jargon] [MISTAKE:2026-10-02 middleware order → auth first]" }

memory— agent skill

Is memory safe to install?

memory — every session starts from what we already know

First session (no memory file), in the user's language

On save (critical)

Audit the pieces. Scan the whole. Decide.