Findings & checks · 126 flagged
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/australia/australia-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/australia/australia-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/australia/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/belgium/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/canada/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/canada/ca-freelance-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/canada/ca-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/france/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/france/france-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/france/france-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/germany/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/germany/germany-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/germany/germany-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/india/india-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/india/india-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/indonesia/id-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/ireland/ie-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/italy/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/japan/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/japan/japan-consumption-tax.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/japan/japan-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/japan/japan-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/malta/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/malta/malta-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/malta/malta-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/netherlands/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/netherlands/netherlands-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/netherlands/netherlands-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/nigeria/ng-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/pakistan/pk-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/portugal/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/saudi-arabia/sa-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/spain/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/spain/spain-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/spain/spain-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/sweden/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/uk/bookkeeping-workflow-base.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/uk/uk-guided-intake.md×4
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 4 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/uk/uk-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ak/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ak/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-al/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-al/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ar/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ar/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-az/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-az/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ca/us-ca-freelance-intake.md×5
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 5 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ca/us-ca-return-assembly.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ca/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ca/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-co/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-co/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ct/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-ct/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-dc/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-dc/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-de/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-de/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-fl/us-federal-return-assembly.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · packages/us-fl/us-tax-workflow-base.md×3
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 3 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
OpenAccountants
The open-source tax layer for AI agents.
1,000+ skills across 190+ jurisdictions — research-verified, with an accountant-verified tier signed off by named CPAs/CAs/EAs. Works with Claude, ChatGPT, Cursor, Windsurf, and any MCP-compatible agent.
⚠️ General reference only — not advice. OpenAccountants provides general tax and accounting reference material for AI-assisted workflows. It is not a law firm, accounting firm, tax preparer, or return-filing service, and its outputs are not tax, legal, accounting, or financial advice. Skills may be incomplete, outdated, or wrong, and are not reviewed for any specific person's facts, elections, deadlines, residency, or local procedures. Always have a qualified professional review outputs before filing, payment, or action. Research-verified skills have not been reviewed by a credentialed accountant.
What it does
You: "I want to file my VAT return in Brazil."
↓ OA loads br-indirect-tax, brazil-vat, brazil-einvoice
AI: Brazil indirect tax rules (PIS/COFINS/ICMS)
Filing workflow, step-by-step
Required documents checklist
E-invoice compliance check
─────────────────────────────────────────
Verified by Ariane Marrocos CRC/SP
[Request accountant review →]You: "I'm a freelancer in South Africa. What do I owe?"
↓ OA loads za-income-tax, za-provisional-tax
AI: ITR12 working paper
Provisional tax schedule (IRP6 — Aug + Feb)
Medical tax credits
Retirement annuity deduction
─────────────────────────────────────────
Verified by Werner Britz CA(SA)
[Request accountant review →]You: "Help me set up a company in Malta."
↓ OA loads malta-formation, malta-income-tax, malta-vat-return
AI: Entity type comparison (Ltd vs partnership vs sole trader)
Registration steps + costs
Post-formation compliance checklist
─────────────────────────────────────────
Verified by Michael Cutajar CPA (Malta)
[Request accountant review →][Install via MCP →](https://www.openaccountants.com/connect) | [Browse skills →](https://www.openaccountants.com/skills) | [For accountants →](https://www.openaccountants.com/for-accountants)
Verified accountants: Werner Britz CA(SA) · Michael Cutajar CPA (Malta) · Ariane Marrocos CRC/SP · James Power (UK) · Mayur Deokar CA (India) · Rilia Putri CA (Indonesia) · Ashish Bista CA (Nepal) · Mário Vale CA (Portugal) · Mehran Habib (Saudi Arabia) · Amir Pelinkovic CPA (US)
Two ways to use
| MCP connector (recommended) | Manual upload from this repo | |
|---|---|---|
| What you get | Accountant-verified skills, named-verifier attribution on every answer, AI-to-human handoff (request_accountant_review routes to a real CPA with your worksheet attached) | Research-verified drafts only — no verifier name, no handoff |
| How | Install once at openaccountants.com/connect | Download a folder, drag .md files into your LLM |
| Best for | Anyone who wants to actually use OpenAccountants | Developers and accountants who want to audit, fork, or contribute |
| Clients | Claude.ai, ChatGPT (Business+), Cursor, Windsurf, Claude Desktop, Claude Code, any MCP-aware client | Any LLM that reads files |
The MCP path is the canonical product. This repo is the open research base that backs it.
Quick start (60 seconds)
1. Find your jurisdiction
packages/
├── malta/ ← income tax + VAT + SSC + payroll + formation + bookkeeping
├── uk/ ← SA103/SA100 + VAT100 + NIC + CGT
├── germany/ ← Einkommensteuer + UStVA + payroll (fullest package)
├── brazil/ ← IRPF + PIS/COFINS + e-invoice + payroll
├── south-africa/ ← ITR12 + VAT + provisional tax
├── ... 130+ more countries
├── us-ca/ ← Federal Schedule C/SE + California state
├── us-ny/ ← Federal + New York state
├── ... 51 US state packages
├── ca-on/ ← Federal T1/T2125 + Ontario
├── ca-qc/ ← Federal + Quebec (incl. QST)
├── ... 13 Canadian province/territory packagesNew here? Read START-HERE.md — scenarios, file lists, what to say to the AI.
Canadian packages: if ca-on/, ca-qc/ etc. are missing, run python3 scripts/build-packages.py once.
2. Upload to your AI
- Claude.ai → Create a Project, add files as Project Knowledge
- ChatGPT → Attach files or create a Custom GPT
- Any other LLM → Attach or paste the files
3. Go
Help me with my 2025 taxes. Here's my bank statement.
Help me set up a company in Malta.
Run my payroll for this month.
Prepare my annual accounts.
Optimize my tax — what deductions am I missing?
Check my invoice compliance for EU e-invoicing.The AI asks a few questions, loads the right skills, and produces a working paper for your accountant.
Verified accountants
These licensed practitioners have reviewed and signed off skills for their jurisdictions. Their name appears on every answer the AI gives.
| Jurisdiction | Verifier | Skills | Profile |
|---|---|---|---|
| South Africa | Werner Britz CA(SA) | 5 | profile |
| Malta | Michael Cutajar CPA (Malta) | 5 | profile |
| Brazil | Ariane Marrocos CRC/SP | 9 | profile |
| United Kingdom | James Power | 15 | profile |
| India | Mayur Deokar CA | 13 | profile |
| Indonesia | Rilia Putri CA | 10 | profile |
| Nepal | Ashish Bista CA | 5 | profile |
| Portugal | Mário Vale CA | 9 | profile |
| Saudi Arabia | Mehran Habib | 9 | profile |
| United States | Amir Pelinkovic CPA | 16 | profile |
| Germany, Australia, Canada | Verification in progress | — | Claim a jurisdiction → |
Verified skills (Tier 1) are served via the MCP server with the verifier's name on every output. The research drafts in this repo are Tier 2.
What's in each package
| File | What it does |
|---|---|
foundation.md | Tells the AI how to work — conservative defaults, output format, classification rules |
intake.md | Onboarding questions, refusal checks, document inference |
[country]-income-tax.md | Income tax brackets, deductions, transaction patterns |
[country]-vat.md | VAT/GST/sales tax rules, supplier patterns, form mappings |
[country]-ssc.md | Social security / pension contributions |
[country]-payroll.md | PAYE withholding, employer filing (15 countries) |
[country]-formation.md | Entity types, registration, costs (13 countries) |
[country]-bookkeeping.md | Chart of accounts, P&L, balance sheet (13 countries) |
[country]-financial-statements.md | Annual accounts, reporting framework (13 countries) |
[country]-transfer-pricing.md | TP documentation, arm's length, CbCR (15 countries) |
[country]-tax-optimization.md | Legal deductions, timing strategies (14 countries) |
[country]-crypto-tax.md | CGT on crypto, DeFi, staking, NFTs (22 countries + all US states) |
[country]-guided-intake.md | Full guided experience (13 countries) |
[country]-return-assembly.md | Cross-checks: VAT × IT × SSC (13 countries) |
Special packages: _cross-border/ (37 skills) · _verticals/ (14 industry skills) · _integrations/ (10 platform skills: Xero, QuickBooks, Stripe, Wise, Shopify, and more)
Coverage
Full accounting suite (13 countries)
Tax + bookkeeping + payroll + formation + financial statements + transfer pricing + tax optimization:
Malta · UK · Germany · Australia · Canada · India · Spain · France · Japan · Netherlands · Portugal · Belgium · United States (CA)
Multi-skill countries (~56 countries)
VAT + income tax + social contributions (and often more):
Argentina, Austria, Belgium, Brazil, Bulgaria, Chile, China, Colombia, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Greece, Hong Kong, Hungary, Indonesia, Ireland, Israel, Kenya, Latvia, Lithuania, Luxembourg, Malaysia, Mexico, New Zealand, Nigeria, Norway, Pakistan, Panama, Peru, Philippines, Poland, Qatar, Romania, Saudi Arabia, Singapore, Slovakia, Slovenia, South Africa, South Korea, Sweden, Switzerland, Taiwan, UAE, and more.
Crypto tax (22 countries + all 51 US states)
Malta, UK, Germany, France, Australia, Canada, Israel, India, Japan, Spain, Netherlands, Portugal, Italy, Singapore, Brazil, Mexico, Sweden, Belgium, Switzerland, South Korea, New Zealand, and every us-<state> package.
VAT/GST only (65 countries)
Consumption tax classification with local supplier pattern libraries. From Albania to Zimbabwe.
Full coverage breakdown: docs/QUALITY-TIERS.md
How the skills work
The supplier pattern library
Every skill contains a lookup table of local vendors. When the AI sees "BANK OF VALLETTA" or "DEUTSCHE TELEKOM" or "STRIPE PAYMENTS UK LTD" on your bank statement, it already knows the classification — no guessing.
Three outcomes per transaction
| Outcome | Means | What happens |
|---|---|---|
| Classified | Documents carry enough info | Applied automatically |
| Assumed | Data missing, conservative default applied | Flagged for your reviewer |
| Needs Input | Can't proceed without asking | One targeted question |
Conservative defaults
When uncertain, the system always assumes MORE tax, never less. Your accountant can override a conservative position. They can't easily undo an aggressive one.
MCP server
Install once, configure once — every future conversation pulls the right skills automatically.
You: "Help me set up a company in Germany and understand payroll"
↓
Claude: list_jurisdictions → sees "germany"
get_skill("germany-formation") → entity types, registration, costs
get_skill("germany-payroll") → PAYE, social security, employer obligations
↓
Claude: walks you through entity choice, registration steps, payroll setupInstall
git clone https://github.com/openaccountants/openaccountants.git
cd openaccountants
pip install ./mcp # requires Python 3.10+Connect
Claude Desktop — add to claude_desktop_config.json:
{
"mcpServers": {
"openaccountants": {
"command": "openaccountants-mcp"
}
}
}Cursor — add to .cursor/mcp.json or via Settings > MCP:
{
"mcpServers": {
"openaccountants": {
"command": "openaccountants-mcp"
}
}
}Full setup, uv instructions, environment variables: mcp/README.md
Are you an accountant?
Most skills are research-verified — drafted from primary legislation but awaiting a credentialed sign-off. Your review moves them to accountant-verified, and your name goes on every answer the AI gives.
You don't need GitHub. Just:
- Find your country's folder under
packages/ - Check rates against your tax authority's website
- Email corrections to [email protected] — any format works
Or: fork, fix, PR. Your name on the skill either way.
130+ countries need accountant reviewers. Pick yours at openaccountants.com/for-accountants.
Contribute
| What | How | Impact |
|---|---|---|
| Verify a rate | Check a number against your tax authority, open a PR | Strengthens a research-verified skill |
| Fix an error | Find a wrong rate or outdated threshold, submit the correction | Prevents bad working papers |
| Add bank patterns | Add how transactions appear on your local bank statement | Fewer misclassifications for every user in your country |
| Add a tax skill | Write an income tax, VAT, or SSC skill for your country | Fills a gap for every user in that jurisdiction |
| Add a domain skill | Bookkeeping, payroll, formation, financial statements, TP, or crypto | Expands the full accounting suite for your jurisdiction |
| Add an industry vertical | Vertical-specific guidance for a profession or business type | Targeted help for that industry |
See CONTRIBUTING.md for the full guide. Every contributor is credited publicly on the skill and at openaccountants.com.
Pull requests: contributions are accepted under the Contributor License Agreement (CLA.md).
For developers
Repo structure
openaccountants/
├── packages/ ← Ready-to-use jurisdiction packages (start here)
│ ├── malta/
│ ├── uk/
│ ├── us-ca/
│ └── ... 130 countries + 51 US states + 13 Canadian provinces
├── skills/ ← Source files (edit these, not packages/)
│ ├── foundation/ ← Workflow bases (universal, VAT, payroll, etc.)
│ ├── federal/ ← US federal skills
│ ├── international/ ← Country-specific skills
│ ├── cross-border/ ← WHT, PE risk, treaty corridors
│ ├── verticals/ ← Industry-specific
│ └── integrations/ ← Platform export formats
├── workflows/ ← 7 structured advisor workflow definitions
├── scripts/
│ └── build-packages.py ← Generates packages/ from skills/
└── docs/Rebuild packages after editing skills
python3 scripts/build-packages.pyKnown limitations
- LLMs hallucinate. These files steer the model; they don't guarantee correct numbers. Always have a qualified professional review before filing.
- Tax law changes. Rates and thresholds go out of date. The repo is a snapshot; openaccountants.com may be ahead of what you cloned.
- Coverage is uneven. 13 countries have the full accounting suite; many jurisdictions have VAT only or partial coverage. Check each country folder's README.
- Newer domains need more eyes. Bookkeeping, payroll, formation, and financial statements skills are research-verified but have fewer accountant sign-offs than the core tax skills.
Disclaimer
OpenAccountants provides general tax and accounting reference material for AI-assisted workflows. It is not a law firm, accounting firm, tax preparer, or return-filing service. Outputs are not tax, legal, accounting, or financial advice, are not reviewed for your specific facts, and must be reviewed by a qualified professional before filing, payment, or action. Using a skill does not create a client relationship. Research-verified skills have not been reviewed by a credentialed accountant; only the accountant-verified tier carries a named practitioner's review, and that review is of reference material, not of any specific taxpayer's situation.
The most up-to-date, verified version is maintained at openaccountants.com.
Contact
[email protected] · openaccountants.com
License
Dual-licensed: AGPL-3.0 for open-source use, commercial license for proprietary products.
Contributions are licensed to the project under the Contributor License Agreement — see CONTRIBUTING.md.