CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.3 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 75 · 1 finding

HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · .github/SECURITY.md

HIGH — when it fires on hostile content the impact is full system-prompt override.

Why it matters

The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.

The exact value spotted

excerpt.github/SECURITY.md· markdown

181. **Delegate output** — text produced by another model/CLI, returned to your host assistant

… (1 chars elided on L18)

19It can contain prompt-injection ("ignore previous instructions"), requests to exfiltrate

20secrets, hidden instructions in HTML comments, or shell commands disguised as guidance.

212. **The task/diff you pass in** — may itself contain secrets or hostile content.

Occurrences

1 occurrence · at L19

How to fix

Remove the override phrase, or rephrase the passage so it does not instruct the agent to discard its rules.

Delete the ignore/disregard/forget … previous instructions sentence.
If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IGNORE-01sha2562e4221a7f996a729…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugin/skills/setup/SKILL.md · 1 file

plugin/skills/setup/SKILL.md1.1 KB · Markdown

name: setup

description: First-run cli-bridge onboarding — see which AI CLIs are installed, set the cost profile and spend caps, and learn what the council can do.

Setup — onboarding walkthrough

Call the doctor MCP tool (server cli-bridge) and show the user what it

found: which CLIs are installed, each lane's cost tier and its source, any warnings (unenforceable cap, sunset countdown, cost mismatch).

Call the setup tool and follow its guidance: ask the user ONE question about

how they pay for their CLIs (flat subscription / metered / mix), then record the answers with set_lane_cost(lane, cost, note) — it persists.

Offer the two enforced caps (docs/BUDGET.md in the repo explains the model):

CLI_BRIDGE_<LANE>_DAILY_LIMIT — max runs/day, exact, works for any lane.
CLI_BRIDGE_DAILY_CREDIT_CAP — estimated spend ceiling (needs per-lane

CREDITS_PER_1K rates; doctor flags when it can't enforce).

No CLIs installed yet? Tell the user about CLI_BRIDGE_MOCK=1 to explore every

tool with canned answers before installing anything.

setup— agent skill

Is setup safe to install?

Setup — onboarding walkthrough

Audit the pieces. Scan the whole. Decide.