CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

228

229Write skills never build. **Generation is always explicit** via `ordito-generate` (§5.4). Sk

… (98 chars elided on L229)

230

231v1.1 added create / structure-edit / nav / delete skills — that's what makes "AI **creates**

… (32 chars elided on L231)

Occurrences

1 occurrence · at L229

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/ordito-add-block/SKILL.md · 1 file

.claude/skills/ordito-add-block/SKILL.md2.3 KB · Markdown

name: ordito-add-block

description: Insert a NEW block into an existing Ordito IR document. Use this when the user has agreed to add a new piece of content (a paragraph, code sample, note, table, step, etc.) to a page that already exists — as opposed to editing an existing block (ordito-update-block) or creating a whole new page (ordito-create-page). Inserts the block at append/at/after/before a sibling, or inside a tab, auto-assigns a unique block id if omitted, validates the result, and bumps meta.updated_at. Does NOT regenerate HTML (ordito-generate is separate) and does NOT ask for confirmation; the calling agent owns that.

allowed-tools: Bash

ordito-add-block

Ordito の 書き込みスキル（仕様 §7.1）。既存 IR ドキュメントにブロックを1つ挿入する（§3.3）。

いつ使うか / 使わないか

使う: 既存ページに新しいブロック（段落・コード・表・注記・手順…）を足すとき。
使わない: 既存ブロックの内容を直す（ordito-update-block）／新しいページを作る（ordito-create-page）／ブロックを消す・動かす（ordito-remove-block / ordito-move-block）。
確認しない／生成しない（§5.4）。

入力（JSON）

{
  "doc": "guides/quickstart",
  "block": { "type": "note", "variant": "info", "text": "補足: …" },
  "position": { "after": "b3" }
}

doc(必須): 既存ページ id。
block(必須): 追加するブロック（type 必須。語彙10種）。id を省くと自動採番（b<N>）。入れ子（tabs 内）の子ブロックの id も自動採番。
position(任意): 挿入位置。append（既定・末尾）/ at:<index> / after:"<block_id>" / before:"<block_id>"。タブ内に入れるときは in_tab: { "block_id": "<tabsブロックid>", "tab_index": 0 } を併せて指定。
ir_dir(任意) / dry_run(任意, bool: 書き込まずプレビュー)。

出力（JSON）

{ ok, doc, block_id, added, position, updated_at, generated:false, note } block_id は採番後の実 id。挿入後に語彙スキーマ検証が通らなければ書き込まずエラー。

実行

echo '{"doc":"guides/quickstart","block":{"type":"paragraph","text":"…"},"position":{"after":"b8"}}' \
  | node "${CLAUDE_SKILL_DIR}/add-block.js"

ordito-add-block— agent skill

Is ordito-add-block safe to install?

ordito-add-block

いつ使うか / 使わないか

入力（JSON）

出力（JSON）

実行

Audit the pieces. Scan the whole. Decide.