CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · gated-products/honey/claude-packages/HD-4005-consultant/skills/stakeholder-mapping/SKILL.md

MEDIUM — it fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.

Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted

excerptgated-products/honey/claude-packages/HD-4005-consultant/skills/stakeholder-mapping/SKILL.md· markdown

59- Revisit the map at each phase gate. Stakeholder positions shift as the engagement progress

… (3 chars elided on L59)

60- Never share the full stakeholder map with the client. It contains your internal assessment

… (55 chars elided on L60)

Occurrences

1 occurrence · at L60

How to fix

Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.

Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IMPERATIVE-01sha2561b156a6029264b2c…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

gated-products/honey/claude-packages/HD-4005-consultant/skills/stakeholder-mapping/SKILL.md · 1 file

gated-products/honey/claude-packages/HD-4005-consultant/skills/stakeholder-mapping/SKILL.md2.3 KB · Markdown

Stakeholder Mapping Skill

Use when starting an engagement. Maps stakeholders by influence/interest, identifies champions and blockers.

When to Activate

User asks to "map stakeholders" or "identify stakeholders"
The /new-engagement command is invoked
User mentions needing to understand "who matters" or "who to talk to"

Process

Identify stakeholders. From available context (engagement brief, org charts, meeting notes), list every person or role that could affect or be affected by the engagement.

Classify each stakeholder. For each, assess:

Influence (High/Low): Can they approve, block, fund, or redirect the engagement?
Interest (High/Low): Do they care about the outcome? Will it affect their work?
Disposition (Champion/Neutral/Blocker): Are they supportive, indifferent, or resistant?

Plot the grid.

                    HIGH INTEREST
                         |
    Keep Informed        |        Manage Closely
    (champions live      |        (decision makers,
     here often)         |         sponsors)
                         |
   LOW INFLUENCE --------+-------- HIGH INFLUENCE
                         |
    Monitor              |        Keep Satisfied
    (minimal effort)     |        (brief updates,
                         |         no surprises)
                         |
                    LOW INTEREST

Define engagement strategy. For each quadrant, specify:

Communication frequency (weekly/fortnightly/monthly/as-needed)
Communication format (meeting/email/report/dashboard)
Key messages tailored to their concerns
Risk if they are neglected

Identify dynamics.

Who are the informal influencers (not in the org chart but respected)?
Are there alliances or tensions between stakeholders?
Who controls budget vs who controls access vs who controls narrative?

Output

A stakeholder map document saved to scope/stakeholder-map.md with:

Stakeholder list with classifications
2x2 grid placement
Engagement strategy per quadrant
Key risks and mitigation for blocker stakeholders

Notes

Revisit the map at each phase gate. Stakeholder positions shift as the engagement progresses.
Never share the full stakeholder map with the client. It contains your internal assessment of their people. Share the communication plan instead.

stakeholder-mapping— agent skill

Is stakeholder-mapping safe to install?

Stakeholder Mapping Skill

When to Activate

Process

Output

Notes

Audit the pieces. Scan the whole. Decide.