CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · ai-readiness-assessment/references/methodology.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptai-readiness-assessment/references/methodology.md· markdown

5Collect information through one or more of these channels.

71. **Conversational Assessment**: Ask the key questions listed under each dimension in `dime

… (108 chars elided on L7)

92. **Document Review**: When the user provides documentation, codebases, or other materials,

… (38 chars elided on L9)

Occurrences

1 occurrence · at L7

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

ai-readiness-assessment/SKILL.md · 1 file

ai-readiness-assessment/SKILL.md3.6 KB · Markdown

name: ai-readiness-assessment

description: Assesses how ready a business is for AI adoption across six dimensions. Evaluates data maturity, tech stack, team skills, process documentation, budget, and culture. Generates a comprehensive ai-readiness-report.md with scores, gap analysis, and recommended starting points. Aligned with OneWave AI's audit methodology.

tools: Read, Write, Glob, Grep, Bash, WebSearch, WebFetch

model: inherit

AI Readiness Assessment Skill

Conduct a structured, evidence-based evaluation of a business's readiness for AI adoption across six dimensions, then produce a detailed ai-readiness-report.md covering scores, gap analysis, and prioritized next steps. Aligned with OneWave AI's pragmatic, ROI-driven audit methodology.

references/dimensions.md — The six dimensions, full 1-5 scoring rubric, and key questions per dimension.
references/methodology.md — Information-gathering, scoring math and interpretation table, gap analysis, recommendation priorities, company-size and industry tailoring, and conversation flow.
references/output-template.md — The complete ai-readiness-report.md structure to fill in.

Workflow

Gather context. Collect information through conversation, document review, and codebase analysis. See references/methodology.md (Phase 1) for channels and the question set in references/dimensions.md.
Score the six dimensions. Rate each from 1 to 5 against the rubric in references/dimensions.md. Be honest and conservative, use half-points for nuance, and record the evidence behind every score.
Calculate the overall score. Apply the weighted formula and map it to a readiness level using the table in references/methodology.md (Phase 2).
Run the gap analysis. For each dimension below 4.0, document current state, target state, the gap, its impact, and the effort to close it (Phase 3).
Build recommendations. Produce prioritized actions across the five OneWave priority tiers, tailoring for company size and industry (Phase 4 and tailoring section).
Generate the report. Write ai-readiness-report.md following references/output-template.md, then highlight the top 3 immediate actions.

The Six Dimensions

Dimension	Weight
Data Maturity	25%
Technology Stack	20%
Team Skills and Capacity	20%
Process Documentation	15%
Budget and Resources	10%
Organizational Culture	10%

See references/dimensions.md for the full rubric and questions.

Core Rules

Never inflate scores. A business that scores 2.0 needs to hear that honestly; false optimism wastes money and time.
Always provide evidence. Back every score with specific observations, not assumptions.
Be actionable. Pair every identified gap with a concrete recommendation.
Respect budget realities. Include cost-appropriate options; not every organization needs enterprise-grade solutions.
Use no jargon without explanation. The report is read by business leaders, not only technologists.
Flag deal-breakers. When a dimension scores 1.0, state explicitly that AI initiatives should not begin until it is addressed.
Consider the full cost. Include ongoing costs (maintenance, retraining, monitoring), not just implementation.
Recommend the right AI. Match recommendations to actual readiness; do not recommend deep learning to a company that has not consolidated its data.
Maintain OneWave AI alignment. Frame all recommendations within pragmatic, ROI-driven AI adoption. Avoid hype; focus on business value.
Use no emojis. Keep all output professional and text-based.

ai-readiness-assessment— agent skill

Is ai-readiness-assessment safe to install?

AI Readiness Assessment Skill

Contents

Workflow

The Six Dimensions

Core Rules

Audit the pieces. Scan the whole. Decide.