CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

228

229Write skills never build. **Generation is always explicit** via `ordito-generate` (§5.4). Sk

… (98 chars elided on L229)

230

231v1.1 added create / structure-edit / nav / delete skills — that's what makes "AI **creates**

… (32 chars elided on L231)

Occurrences

1 occurrence · at L229

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/ordito-move-block/SKILL.md · 1 file

.claude/skills/ordito-move-block/SKILL.md1.9 KB · Markdown

name: ordito-move-block

description: Reorder or re-parent an existing block within an Ordito IR document (write to the IR store). Use this when the user wants to change the ORDER of content on a page, or move a block into/out of a tab — without changing the block's content. Moves exactly one existing block by id to a new position (at/after/before a sibling, or inside a tab), validates the result, and bumps meta.updated_at. Does NOT regenerate HTML (ordito-generate is separate) and does NOT ask for confirmation; the calling agent owns that.

allowed-tools: Bash

ordito-move-block

Ordito の 書き込みスキル（仕様 §7.1）。既存ブロックを同一ドキュメント内で並べ替え／再配置する（§3.3）。

いつ使うか / 使わないか

使う: ページ内のブロックの順序を変える、タブの内外へ移すとき（内容は変えない）。
使わない: 内容を直す（ordito-update-block）／追加・削除（ordito-add-block / ordito-remove-block）／ナビの並びを変える（ordito-edit-collection）。
確認しない／生成しない（§5.4）。

入力（JSON）

{ "doc": "guides/quickstart", "block_id": "b8", "position": { "before": "b4" } }

doc(必須) / block_id(必須): 動かす既存ブロック id。
position(必須): 移動先。at:<index> / after:"<bid>" / before:"<bid>"、タブ内へは in_tab:{ "block_id","tab_index" }。基準ブロックに自分自身は指定不可。
ir_dir(任意) / dry_run(任意)。

出力（JSON）

{ ok, doc, block_id, moved, position, updated_at, generated:false, note } 移動後に語彙スキーマ検証が通らなければ書き込まずエラー。

実行

echo '{"doc":"guides/quickstart","block_id":"b8","position":{"before":"b4"}}' \
  | node "${CLAUDE_SKILL_DIR}/move-block.js"

ordito-move-block— agent skill

Is ordito-move-block safe to install?

ordito-move-block

いつ使うか / 使わないか

入力（JSON）

出力（JSON）

実行

Audit the pieces. Scan the whole. Decide.