CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

22.4 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 3 flagged

Securityscore 64 · 3 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/agents/improvement-intake-agent.agent.md×3

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerpt.github/agents/improvement-intake-agent.agent.md· markdown

45Read the response carefully. Extract everything you can before asking follow-ups.

46Do not ask for information already given.

48---

Occurrences

3 occurrences · first at L46, also L53, L280

Show all 3 locations

Line

File

L46

.github/agents/improvement-intake-agent.agent.md

L53

.github/agents/improvement-intake-agent.agent.md

L280

.github/agents/improvement-intake-agent.agent.md

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/agent-memory/skills/rlm-cleanup-agent/SKILL.md · 1 file

plugins/agent-memory/skills/rlm-cleanup-agent/SKILL.md2.5 KB · Markdown

name: rlm-cleanup-agent

plugin: rlm-factory

description: |

Removes stale and orphaned entries from the RLM Summary Ledger.

Use after files are deleted, renamed, or moved to keep the ledger in sync with the filesystem.

user: "Clean up the RLM cache after I renamed some files"

assistant: "I'll use rlm-cleanup-agent to remove stale entries from the ledger."

</example>

user: "The RLM ledger has entries for files that no longer exist"

assistant: "I'll run rlm-cleanup-agent to prune orphaned entries."

</example>

allowed-tools: Bash, Read, Write

Dependencies

This skill requires Python 3.8+ and standard library only. No external packages needed.

To install this skill's dependencies:

pip-compile ./requirements.in
pip install -r ./requirements.txt

See ./requirements.txt for the dependency lockfile (currently empty — standard library only).

RLM Cleanup Agent

Role

You remove stale and orphaned entries from the RLM Summary Ledger. An entry is stale when its file no longer exists or has moved. Running this regularly keeps the ledger accurate.

This is a write operation. Always confirm scope before running.

Prerequisites

Profile not configured? Run rlm-init skill first: SKILL.md

When to Run

After deleting or renaming files that were previously summarized
After a major refactor that moved directories
When inventory.py reports entries with no matching file on disk
Periodically as housekeeping (e.g. after a merge)

Execution Protocol

1. Confirm profiles to clean

Default: run against all configured profiles. Ask if unsure:

"Should I clean all profiles (project + tools), or a specific one?"

2. Dry run first -- show what will be removed

python ./scripts/cleanup_cache.py \
  --profile project --dry-run

python ./scripts/cleanup_cache.py \
  --profile tools --dry-run

Report: "Found N stale entries across profiles: [list of paths]"

3. Apply -- only after confirming with the user

python ./scripts/cleanup_cache.py \
  --profile project --apply

python ./scripts/cleanup_cache.py \
  --profile tools --apply

4. Verify

python ./scripts/inventory.py --profile project

Report the new coverage percentage.

Rules

Always dry-run first. Never apply without showing the user what will be deleted.
*Never edit `_cache/.md` directly.* Always use cleanup_cache.py.
Source Transparency Declaration: state which profiles were cleaned and how many entries removed.

rlm-cleanup-agent— agent skill

Is rlm-cleanup-agent safe to install?

Dependencies

RLM Cleanup Agent

Role

Prerequisites

When to Run

Execution Protocol

1. Confirm profiles to clean

2. Dry run first -- show what will be removed

3. Apply -- only after confirming with the user

4. Verify

Rules

Audit the pieces. Scan the whole. Decide.