ln-316-review-refinement-worker 92/100

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.6 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 2 flagged

Securityscore 76 · 2 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · plugins/agile-workflow/skills/ln-316-review-refinement-worker/references/agents/prompt_templates/iterative_refinement.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptplugins/agile-workflow/skills/ln-316-review-refinement-worker/references/agents/prompt_templates/iterative_refinement.md· markdown

8- Write your review result to the output file specified by -o flag

9- Focus on analysis — avoid modifying project files unless a fix is trivial and obvious

10- DO NOT ask clarifying questions — follow this prompt to completion autonomously

11- Target completing your analysis within 10 minutes

Occurrences

1 occurrence · at L10

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2563507b488e8245eb0…rubric 365aacaView on GitHub

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The exact value spotted

excerptplugins/agile-workflow/skills/ln-316-review-refinement-worker/references/agents/prompt_templates/review_base.md· markdown

8{mode_constraints}

9- If you cannot access a resource — report it clearly, do not skip silently

10- DO NOT ask clarifying questions or request additional context — you have everything you ne

… (108 chars elided on L10)

11- Target completing your analysis within 10 minutes. Prioritize depth over breadth — focus o

… (61 chars elided on L11)

Occurrences

1 occurrence · at L10

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2563507b488e8245eb0…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/agile-workflow/skills/ln-316-review-refinement-worker/SKILL.md · 1 file

plugins/agile-workflow/skills/ln-316-review-refinement-worker/SKILL.md7.5 KB · Markdown

name: ln-316-review-refinement-worker

description: "Use when an evaluation run requires bounded iterative refinement with trace and cleanup evidence."

license: MIT

Paths: File paths (references/, ../ln-*) are relative to this skill directory.

Type: L3 Worker Category: 3XX Planning

Mandatory Read

MANDATORY READ: Load references/evaluation_worker_runtime_contract.md, references/evaluation_summary_contract.md, references/refinement_trace_contract.md, references/cleanup_evidence_contract.md MANDATORY READ: Load references/agents/prompt_templates/iterative_refinement.md, references/agents/prompt_templates/refinement_perspectives.md MANDATORY READ: Load references/monitor_integration_pattern.md, references/agent_review_workflow.md (Step: Iterative Refinement)

Purpose

run 2-stage refinement after merge using the non-host advisor agent via agent_runner.mjs
Stage 1: 3 parallel independent advisor sessions (dry_run_executor, new_dev_tester, adversarial_reviewer)
Stage 2: 1 sequential advisor session (final_sweep) after merging Stage 1 results
record refinement trace and cleanup evidence for every advisor session

Critical: refinement launches the advisor externally. Do NOT use host-native sub-agents for this phase.

Runtime

Runtime family:

evaluation-worker-runtime

Required manifest fields:

identifier
phase_order
summary_kind=review-refinement
operation=refinement

Recommended phase_order:

PHASE_0_CONFIG
PHASE_1_STAGE1_PARALLEL
PHASE_2_STAGE2_FINAL_SWEEP
PHASE_3_WRITE_SUMMARY
PHASE_4_SELF_CHECK

Critical: Independent Sessions

Each perspective MUST be a separate node agent_runner.mjs --agent {advisor_agent} invocation. Do NOT combine multiple perspectives into a single advisor prompt or session. Each iter{N}/ subdirectory = independent advisor process with its own PID.

Perspective Classification

Stage	Perspective	Execution	Purpose
1	`dry_run_executor`	parallel	Catch unexecutable steps, sequencing errors
1	`new_dev_tester`	parallel	Catch implicit knowledge gaps, undefined terms
1	`adversarial_reviewer`	parallel	Catch guaranteed failures, silent corruption
2	`final_sweep`	after merge	Catch regressions and drift from Stage 1 fixes

All 4 perspectives are MANDATORY. generic_quality is not included — it is covered by the Phase 2 advisor review (review_base.md + mode template).

Stage 1: Parallel Specialized Reviews

Build artifact: Read current state of reviewed artifact (Story+Tasks / plan file / context docs).
For EACH of 3 perspectives, in parallel:

a. Load perspective from refinement_perspectives.md matching the perspective name. b. Build prompt: fill iterative_refinement.md placeholders ({artifact_type}, {artifact_content}, {project_context}, {review_perspective}, {iteration_number}, {max_iterations}, {previous_findings_summary}). c. Save prompt to .hex-skills/agent-review/refinement/{identifier}/iter{N}/prompt.md

iter1/ = dry_run_executor
iter2/ = new_dev_tester
iter3/ = adversarial_reviewer

d. Launch independent advisor process:

      node references/agents/agent_runner.mjs --agent {advisor_agent} \
        --prompt-file .hex-skills/agent-review/refinement/{identifier}/iter{N}/prompt.md \
        --output-file .hex-skills/agent-review/refinement/{identifier}/iter{N}/result.md \
        --cwd {project_dir}

Wait for ALL 3 via runtime sync-agent; Claude hosts may use Monitor for observability (see Waiting section below).
Parse results from each completed session: extract JSON from ## Structured Data section.
Merge findings: deduplicate by (area, issue), keep higher confidence.
Classify: HIGH (impact_percent >= 20%), MEDIUM (10-19%), LOW (< 10%).
Architecture Gate on each accepted fix: "Does this implement the correct architecture directly, without backward compatibility shims?"
Apply accepted fixes.
Kill all 3 processes: node agent_runner.mjs --verify-dead {pid} per session. MANDATORY on Windows.
Record cleanup evidence per cleanup_evidence_contract.md for each session.
Build `{previous_findings_summary}` for Stage 2.

If ALL 3 advisor sessions fail → EXIT(ERROR), skip Stage 2. If some fail → continue with available results, record partial errors.

Stage 2: Final Sweep

Build artifact: Read post-fix state after Stage 1.
Load `final_sweep` perspective from refinement_perspectives.md.
Build prompt with {previous_findings_summary} from Stage 1.
Save prompt to .hex-skills/agent-review/refinement/{identifier}/iter4/prompt.md.
Launch advisor (single independent session).
Wait via runtime sync-agent; Claude hosts may use Monitor for observability.
Parse result, apply any accepted fixes (Architecture Gate on each).
Kill process, record cleanup evidence.

Waiting for Advisor Results (MANDATORY)

Use the active runtime sync-agent command before parsing or merge gates. Monitor is optional Claude Code observability only.

For EACH launched advisor process:

When running under Claude Code, optional observability:

Monitor(command="tail -f {agent_log} | grep --line-buffered -E 'Phase|ERROR|DONE'", timeout_ms=120000, description="advisor refinement {perspective_name}")

After each sync/monitor cycle:

Check result file for  marker.
Marker present → parse result, proceed.
Marker absent, log growing → continue runtime sync or optional monitor cycle.
Marker absent, log stale >3 min → run Liveness Protocol (see agent_review_workflow.md).

Do NOT use sleep or manual stat-polling as the primary wait mechanism.

Process Cleanup

After each advisor call (both stages):

Extract pid from runner stdout or metadata.
Run node references/agents/agent_runner.mjs --verify-dead {pid}.
Record cleanup evidence per cleanup_evidence_contract.md.
CLI advisor processes can accumulate on Windows if not killed.

Exit States

State	Meaning
`COMPLETED`	Both stages done, all results merged
`PARTIAL_ERROR`	Stage 1 had failures but Stage 2 completed
`ERROR`	All Stage 1 advisor sessions failed (Stage 2 skipped)
`SKIPPED`	No advisor available in health check

Summary

Emit summary_kind=review-refinement.

Payload must include:

worker=ln-316
status
operation=refinement
warnings

Prefer these fields:

stages_completed (int: 1 or 2)
exit_reason (enum: COMPLETED, PARTIAL_ERROR, ERROR, SKIPPED)
applied (int: total suggestions applied across all stages)
architecture_gate_rejections (count)
stage1_perspectives (list of completed perspective names)
stage1_failed (list of failed perspective names)
metadata.refinement_trace

Definition of Done

[ ] Stage 1: all 3 advisor sessions launched in parallel
[ ] Stage 2: final_sweep launched after Stage 1 merge
[ ] All advisors launched via agent_runner.mjs (not host-native sub-agents)
[ ] Runtime sync-agent used for waiting; Claude Monitor is optional observability
[ ] Refinement trace recorded per refinement_trace_contract.md
[ ] Cleanup evidence recorded for all launched processes
[ ] review-refinement summary written
[ ] Self-check passed

Version: 2.0.0 Last Updated: 2026-04-13

ln-316-review-refinement-worker— agent skill

Is ln-316-review-refinement-worker safe to install?

Review Refinement Worker

Mandatory Read

Purpose

Runtime

Refinement State Machine

Critical: Independent Sessions

Perspective Classification

Stage 1: Parallel Specialized Reviews

Stage 2: Final Sweep

Waiting for Advisor Results (MANDATORY)

Process Cleanup

Exit States

Summary

Definition of Done

Audit the pieces. Scan the whole. Decide.