Critical Thinking Mcp— agent skill

Critical Thinking Mcp — independently scanned and version-tracked by SaferSkills.

Is Critical Thinking Mcp safe to install?

SaferSkills independently audited Critical Thinking Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 221 high-severity and 362 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

Score
45/100
●●●●●○○○○○
↑ +0 since first scan (45 → 45)Re-scan~30s
Latest scan
ScannedJun 23, 2026 · 33d ago
Scans run1 over 90 days
Detectors55 checks · 5 categories
Findings362 warnings · 221 high
EngineSaferSkills 2b638c6
View methodology →
SaferSkills installs
This week0
This month0
All time0
CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
0
0.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
100
20.0 pts
Maintenancestaleness, pinning, CI
15%
100
15.0 pts
TransparencySKILL.md, perms, README
15%
100
15.0 pts
Communityinstalls, verify, response
15%
100
15.0 pts

Findings & checks · 583 flagged

Securityscore 0 · 583 findings
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_ab_clean_live_2026-04-09.md×18
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_2026-04-09.md· markdown
377{"type":"system","subtype":"hook_response","hook_id":"ebaa9daf-9b85-4160-8494-5854359a5ab7",
… (108 chars elided on L377)
378{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L378)
379{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01Ma4jUGZq9qCPeHPU9t6XP
… (108 chars elided on L379)
380{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01Ma4jUGZq9qCPeHPU9t6XP
… (108 chars elided on L380)
381{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775775600,"rate
… (108 chars elided on L381)
Occurrences
18 occurrences · first at L379, also L654, L658 +15 more
Show all 18 locations
Line
File
L379
docs/reports/ct_ab_clean_live_2026-04-09.md
L654
docs/reports/ct_ab_clean_live_2026-04-09.md
L658
docs/reports/ct_ab_clean_live_2026-04-09.md
L812
docs/reports/ct_ab_clean_live_2026-04-09.md
L1095
docs/reports/ct_ab_clean_live_2026-04-09.md
L1099
docs/reports/ct_ab_clean_live_2026-04-09.md
L1249
docs/reports/ct_ab_clean_live_2026-04-09.md
L1516
docs/reports/ct_ab_clean_live_2026-04-09.md
L1520
docs/reports/ct_ab_clean_live_2026-04-09.md
L1663
docs/reports/ct_ab_clean_live_2026-04-09.md
L1928
docs/reports/ct_ab_clean_live_2026-04-09.md
L1932
docs/reports/ct_ab_clean_live_2026-04-09.md
L2080
docs/reports/ct_ab_clean_live_2026-04-09.md
L2351
docs/reports/ct_ab_clean_live_2026-04-09.md
L2355
docs/reports/ct_ab_clean_live_2026-04-09.md
L2505
docs/reports/ct_ab_clean_live_2026-04-09.md
L2777
docs/reports/ct_ab_clean_live_2026-04-09.md
L2781
docs/reports/ct_ab_clean_live_2026-04-09.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha25615d5b44d7048219crubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md×18
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_calibrated_2026-04-09.md· markdown
380{"type":"system","subtype":"hook_response","hook_id":"a97318de-17d2-4d4c-be35-28eb883de097",
… (108 chars elided on L380)
381{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L381)
382{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01PXHmivY3gbnLiKBuR2Vi8
… (108 chars elided on L382)
383{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01PXHmivY3gbnLiKBuR2Vi8
… (107 chars elided on L383)
384{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775775600,"rate
… (108 chars elided on L384)
Occurrences
18 occurrences · first at L382, also L766, L770 +15 more
Show all 18 locations
Line
File
L382
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L766
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L770
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L927
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1413
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1417
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1571
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1986
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1990
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2134
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2506
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2510
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2660
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3081
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3085
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3239
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3674
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3678
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha2566c598db6efe5718erubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md×26
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md· markdown
408{"type":"system","subtype":"hook_response","hook_id":"27696570-ee99-42c7-833e-8e3090364081",
… (108 chars elided on L408)
409{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L409)
410{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01FQ1s62SWRU9xS7xTxPnfC
… (108 chars elided on L410)
411{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01FQ1s62SWRU9xS7xTxPnfC
… (107 chars elided on L411)
412{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775793600,"rate
… (108 chars elided on L412)
Occurrences
26 occurrences · first at L410, also L811, L815 +23 more
Show all 26 locations
Line
File
L410
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L811
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L815
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L986
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1511
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1515
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1980
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1984
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2161
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2626
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2630
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3214
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3218
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3379
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3768
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3772
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3955
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4447
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4451
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4932
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4936
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5113
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5665
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5669
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L6220
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L6224
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256916d3dead25c6aedrubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_ab_clean_live_enforced_2026-04-09.md×27
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_enforced_2026-04-09.md· markdown
375{"type":"system","subtype":"hook_response","hook_id":"5c6c8a51-c235-4a55-9127-25a0eb5414de",
… (108 chars elided on L375)
376{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L376)
377{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_014asvNNkv6HrPWckXJbuBu
… (108 chars elided on L377)
378{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_014asvNNkv6HrPWckXJbuBu
… (108 chars elided on L378)
379{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775775600,"rate
… (108 chars elided on L379)
Occurrences
27 occurrences · first at L377, also L782, L786 +24 more
Show all 27 locations
Line
File
L377
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L782
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L786
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L959
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1460
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1464
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1927
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1931
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2120
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2627
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2631
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3176
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3180
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3863
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3867
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4332
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4336
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4511
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4979
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4983
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5435
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5439
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5617
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L6112
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L6116
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L6614
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L6618
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha2561378f23c5aee794brubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md×34
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md· markdown
550{"type":"system","subtype":"hook_response","hook_id":"28d00081-9bc6-4a26-aab6-a1ac8d225fd3",
… (108 chars elided on L550)
551{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L551)
552{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01LVvmS436Dt7oe3w4SMe74
… (108 chars elided on L552)
553{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01LVvmS436Dt7oe3w4SMe74
… (108 chars elided on L553)
554{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775793600,"rate
… (108 chars elided on L554)
Occurrences
34 occurrences · first at L552, also L725, L1117 +31 more
Show all 34 locations
Line
File
L552
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L725
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1117
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1121
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1295
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1504
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2034
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2038
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2533
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2537
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2719
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2940
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3383
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3387
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3872
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3876
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4035
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4224
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4636
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4640
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5098
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5102
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5284
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5492
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5913
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5917
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6370
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6374
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6556
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6789
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L7241
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L7245
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L7695
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L7699
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha2569a6e36b305614361rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md×34
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md· markdown
550{"type":"system","subtype":"hook_response","hook_id":"541eb1a2-47ba-4a28-bf6c-9f33e2f5fd81",
… (108 chars elided on L550)
551{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L551)
552{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_015JeUBPPLmuXZPT6Fmgu72
… (108 chars elided on L552)
553{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_015JeUBPPLmuXZPT6Fmgu72
… (108 chars elided on L553)
554{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775847600,"rate
… (108 chars elided on L554)
Occurrences
34 occurrences · first at L552, also L780, L1313 +31 more
Show all 34 locations
Line
File
L552
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L780
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1313
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1317
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1836
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1840
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2020
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2233
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2667
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2671
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3018
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3022
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3210
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3452
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4015
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4019
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4525
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4529
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4702
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4875
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5278
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5282
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5464
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5688
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6172
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6176
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6660
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6664
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6864
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7103
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7595
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7599
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L8111
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L8115
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha25608cbb693bbf9bf4brubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md×64
HIGHonce decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerptdocs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md· markdown
1587{"type":"system","subtype":"hook_response","hook_id":"c87f7745-9295-4e90-8bea-914375c35214",
… (108 chars elided on L1587)
1588{"type":"system","subtype":"init","cwd":"/Users/adilevinshtein/Documents/dev/ct-mcp/benchmar
… (108 chars elided on L1588)
1589{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01QkyUDepzjFJ76nTkqq8A4
… (108 chars elided on L1589)
1590{"type":"assistant","message":{"model":"claude-sonnet-4-6","id":"msg_01QkyUDepzjFJ76nTkqq8A4
… (108 chars elided on L1590)
1591{"type":"rate_limit_event","rate_limit_info":{"status":"allowed","resetsAt":1775865600,"rate
… (108 chars elided on L1591)
Occurrences
64 occurrences · first at L1589, also L1856, L2490 +61 more
Show all 64 locations
Line
File
L1589
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L1856
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2490
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2494
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2499
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2912
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3471
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3483
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3719
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3991
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L4870
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L4874
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L4879
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L5806
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L5812
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7086
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7331
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7775
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7779
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8159
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8159
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8478
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8482
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8730
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8967
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9531
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9535
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10768
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11041
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11711
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11715
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11720
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12372
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12376
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12579
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13231
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13231
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13491
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13722
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14473
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14477
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14482
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14679
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15604
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15604
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15862
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L16107
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L16936
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L16940
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17143
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17143
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17143
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17948
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18214
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18500
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L19201
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L19205
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L19210
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20059
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20065
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20286
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20286
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20493
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L21136
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256dc02cd16431f86e4rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_ab_clean_live_2026-04-09.md×24
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_2026-04-09.md· markdown
2002"low",
2003"--continue",
2004"You are participating in a controlled A/B experiment.\n\nRules:\n- Answer the prompt exactl
… (106 chars elided on L2004)
2005]
2006```
Occurrences
24 occurrences · first at L265, also L303, L406 +21 more
Show all 24 locations
Line
File
L265
docs/reports/ct_ab_clean_live_2026-04-09.md
L303
docs/reports/ct_ab_clean_live_2026-04-09.md
L406
docs/reports/ct_ab_clean_live_2026-04-09.md
L446
docs/reports/ct_ab_clean_live_2026-04-09.md
L685
docs/reports/ct_ab_clean_live_2026-04-09.md
L736
docs/reports/ct_ab_clean_live_2026-04-09.md
L839
docs/reports/ct_ab_clean_live_2026-04-09.md
L884
docs/reports/ct_ab_clean_live_2026-04-09.md
L1126
docs/reports/ct_ab_clean_live_2026-04-09.md
L1173
docs/reports/ct_ab_clean_live_2026-04-09.md
L1276
docs/reports/ct_ab_clean_live_2026-04-09.md
L1321
docs/reports/ct_ab_clean_live_2026-04-09.md
L1547
docs/reports/ct_ab_clean_live_2026-04-09.md
L1587
docs/reports/ct_ab_clean_live_2026-04-09.md
L1690
docs/reports/ct_ab_clean_live_2026-04-09.md
L1732
docs/reports/ct_ab_clean_live_2026-04-09.md
L1959
docs/reports/ct_ab_clean_live_2026-04-09.md
L2004
docs/reports/ct_ab_clean_live_2026-04-09.md
L2107
docs/reports/ct_ab_clean_live_2026-04-09.md
L2145
docs/reports/ct_ab_clean_live_2026-04-09.md
L2382
docs/reports/ct_ab_clean_live_2026-04-09.md
L2429
docs/reports/ct_ab_clean_live_2026-04-09.md
L2532
docs/reports/ct_ab_clean_live_2026-04-09.md
L2577
docs/reports/ct_ab_clean_live_2026-04-09.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md×24
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_calibrated_2026-04-09.md· markdown
266- Do not use CT-MCP tools.
267- Do not use any other tools.
268- Do not ask follow-up questions.
269- Keep the answer under 120 words.
270 
Occurrences
24 occurrences · first at L268, also L306, L414 +21 more
Show all 24 locations
Line
File
L268
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L306
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L414
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L449
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L798
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L851
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L959
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L994
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1445
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1495
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1603
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L1653
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2018
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2058
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2166
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2201
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2538
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2584
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2692
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L2727
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3113
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3163
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3271
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
L3321
docs/reports/ct_ab_clean_live_calibrated_2026-04-09.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md×32
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md· markdown
292- Do not use CT-MCP tools.
293- Do not use any other tools.
294- Do not ask follow-up questions.
295- Keep the answer under 120 words.
296 
Occurrences
32 occurrences · first at L294, also L334, L455 +29 more
Show all 32 locations
Line
File
L294
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L334
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L455
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L490
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L865
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L910
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1064
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1101
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1556
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L1630
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2037
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2085
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2230
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2280
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2670
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L2764
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3263
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3303
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3424
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3459
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3828
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L3879
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4033
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4068
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4492
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4564
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L4989
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5037
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5209
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5256
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5710
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
L5824
docs/reports/ct_ab_clean_live_delta_turn3_2026-04-09.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_ab_clean_live_enforced_2026-04-09.md×34
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_enforced_2026-04-09.md· markdown
261- Do not use CT-MCP tools.
262- Do not use any other tools.
263- Do not ask follow-up questions.
264- Keep the answer under 120 words.
265 
Occurrences
34 occurrences · first at L263, also L301, L424 +31 more
Show all 34 locations
Line
File
L263
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L301
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L424
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L459
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L838
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L883
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1035
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1070
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1500
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1573
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L1991
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2044
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2195
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2246
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2667
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L2773
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3227
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3267
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3418
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3453
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3903
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L3976
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4389
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4435
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4584
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L4623
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5019
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5092
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5494
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5541
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5692
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L5743
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L6152
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
L6257
docs/reports/ct_ab_clean_live_enforced_2026-04-09.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md×46
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md· markdown
434- Do not use CT-MCP tools.
435- Do not use any other tools.
436- Do not ask follow-up questions.
437- Keep the answer under 120 words.
438 
Occurrences
46 occurrences · first at L436, also L476, L608 +43 more
Show all 46 locations
Line
File
L436
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L476
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L608
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L649
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L758
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L793
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1174
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1219
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1387
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1428
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1537
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L1572
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2076
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2157
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2594
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2643
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2819
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2864
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L2973
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3019
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3425
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3520
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3922
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L3959
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4112
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4148
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4257
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4292
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4678
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L4747
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5159
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5208
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5369
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5416
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5525
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5564
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L5955
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6026
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6431
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6480
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6661
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6713
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6822
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L6872
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L7283
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
L7380
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-09.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md×46
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md· markdown
424- Do not use CT-MCP tools.
425- Do not use any other tools.
426- Do not ask follow-up questions.
427- Keep the answer under 120 words.
428 
Occurrences
46 occurrences · first at L426, also L476, L658 +43 more
Show all 46 locations
Line
File
L426
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L476
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L658
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L704
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L813
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L858
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1355
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1467
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1891
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L1944
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2107
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2157
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2266
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2311
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2703
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L2791
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3077
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3134
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3321
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3376
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3485
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L3544
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4057
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4179
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4577
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4626
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4753
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4799
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4908
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L4953
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5334
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5388
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5560
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5612
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5721
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L5766
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6214
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6308
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6725
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6788
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L6967
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7027
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7136
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7190
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7637
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
L7743
docs/reports/ct_ab_clean_live_enforced_prompt_classifier_2026-04-10_topology.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md×150
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md· markdown
1416- Do not use CT-MCP tools.
1417- Do not use any other tools.
1418- Do not ask follow-up questions.
1419- Keep the answer under 180 words.
1420 
Occurrences
150 occurrences · first at L1418, also L1512, L1692 +147 more
Show all 150 locations
Line
File
L1418
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L1512
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L1692
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L1779
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L1886
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2151
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2587
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2663
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2701
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2702
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2796
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2871
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2909
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2910
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L2943
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3202
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3468
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3469
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3569
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3642
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3839
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L3914
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L4021
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L4534
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L4910
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L5506
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L5895
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L5966
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6004
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6005
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6083
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6153
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6191
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6192
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6225
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6571
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6823
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6824
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L6930
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7009
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7178
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7254
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7361
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7557
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7864
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7933
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7971
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L7972
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8050
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8118
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8156
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8157
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8190
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8363
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8471
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8472
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8576
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8653
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8818
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8890
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L8997
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9214
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9627
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9703
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9741
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9742
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9832
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9906
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9944
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9945
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L9978
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10227
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10509
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10510
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10614
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10691
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10886
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L10964
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11071
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11357
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L11751
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12057
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12464
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12538
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12576
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12577
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12669
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12739
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12777
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12778
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L12811
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13009
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13228
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13229
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13339
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13414
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13574
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13645
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L13752
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14166
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14566
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14638
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14676
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14677
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14765
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14836
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14874
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14875
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L14908
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15310
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15601
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15602
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15707
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15785
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L15954
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L16030
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L16137
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L16603
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17029
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17102
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17140
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17141
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17231
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17303
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17341
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17342
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17375
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17740
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17945
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L17946
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18055
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18137
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18345
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18423
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18530
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L18937
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L19241
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L19771
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20161
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20245
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20283
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20284
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20375
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20452
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20490
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20491
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20524
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L20883
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L21129
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
L21130
docs/reports/ct_beta2_ab_matrix_2026-04-10_release_gate_r2.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · duckexperiments/AGENT_RUNNER_PROMPT.md×4
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptduckexperiments/AGENT_RUNNER_PROMPT.md· markdown
41This section is for the receiving agent.
42 
43If a user tells you to use this file to run one experiment cell, do not ask them to restate
… (65 chars elided on L43)
44 
45When invoked with:
Occurrences
4 occurrences · first at L43, also L63, L88 +1 more
Show all 4 locations
Line
File
L43
duckexperiments/AGENT_RUNNER_PROMPT.md
L63
duckexperiments/AGENT_RUNNER_PROMPT.md
L88
duckexperiments/AGENT_RUNNER_PROMPT.md
L405
duckexperiments/AGENT_RUNNER_PROMPT.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · duckexperiments/RUN_PROFILES.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptduckexperiments/RUN_PROFILES.md· markdown
58Rules:
59- Answer the prompt exactly once.
60- Do not ask follow-up questions.
61- Do not use tools.
62- Keep the full answer under 120 words.
Occurrences
1 occurrence · at L60
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · examples/real_world_plan_analysis.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptexamples/real_world_plan_analysis.md· markdown
151- Do dependencies work? *(consistency)*
152 
153They stop there. They don't ask:
154- Will parallel tracks collide on shared resources?
155- Are steps specific enough to execute without guessing?
Occurrences
1 occurrence · at L153
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha256ce5204b52388d24frubric 365aacaView on GitHub
Supply chainscore 100 · 0 findings
All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenancescore 100 · 0 findings
All maintenance checks passedNo findings in this category for the latest scan.pass
Transparencyscore 100 · 0 findings
All transparency checks passedNo findings in this category for the latest scan.pass
Communityscore 100 · 0 findings
All community checks passedNo findings in this category for the latest scan.pass
Vendor response · right of reply
Are you the maintainer? Submit a response →

Audit the pieces. Scan the whole. Decide.

~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.