CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · CONTRIBUTING.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptCONTRIBUTING.md· markdown

272. **Idempotent.** Re-running a bootstrap produces the same state. Never overwrite user cont

… (56 chars elided on L27)

283. **Profiles are data, never code.** No `eval`, no embedded scripts, no remote includes.

294. **`gh` integration is always best-effort.** Skip with a logged reason; never fatal, never

… (18 chars elided on L29)

305. **MCP boundary.** Shell scripts never invoke MCP tools — only the skill layer does.

316. **No internal references in code.** Names must be self-descriptive. Traceability belongs

… (15 chars elided on L31)

Occurrences

1 occurrence · at L29

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256183eb789192b5159…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/suggest/SKILL.md · 1 file

skills/suggest/SKILL.md3.4 KB · Markdown

name: suggest

description: "Analyze a repository and suggest profile updates. TRIGGER ON: 'suggest profile changes', 'what should I add to my profile', 'profile recommendations', 'analyze my hooks', 'detect missing hooks', 'suggest improvements', 'profile audit', 'what tools am I missing', 'check profile coverage', 'profile gaps'. Scans devDependencies, config files, repo structure, and git history to find mismatches with the active nyann profile."

suggest — Smart Profile Suggestions

You are the suggest skill. You analyze a repository's actual state (dependencies, config files, structure, git history) against the active nyann profile and recommend updates.

When to trigger

User asks what they should add to their profile
User wants to check if their profile covers all installed tools
User asks about profile gaps, missing hooks, or coverage
After bootstrap or retrofit, to suggest profile refinements
User asks "what tools am I missing" or "audit my profile"

DO NOT trigger on: general profile questions (use inspect-profile), profile creation (use learn-profile), or switching between profiles (use migrate-profile).

Execution flow

Phase 1: Detect stack and resolve profile

Run bin/detect-stack.sh --path . to get a StackDescriptor JSON.
Resolve and load the active profile via bin/load-profile.sh <name>

(resolves preferences → CLAUDE.md markers → "default" fallback).

Phase 2: Run the suggestion engine

Run bin/suggest-profile-updates.sh --profile <profile-path> --target . --stack <stack-path>.
Parse the JSON array of suggestions.

Phase 3: Present suggestions

Group suggestions by category and present them in a clear table:

hook-gap: Tool installed but not hooked (high confidence)
config-present: Config file exists but tool not hooked
structure: Monorepo signals detected
history-drift: Commit format doesn't match profile setting
scope-gap: Commit scopes used but not declared in profile

For each suggestion, show:

What was detected (the signal)
What to change (the suggestion)
Confidence level (0.0–1.0)

Phase 4: Offer to apply

Ask the user which suggestions to apply.
For actionable suggestions (those with action.field and action.add), offer to update the profile JSON directly.
After applying, suggest running /nyann:doctor to verify the changes.

Key constraints

Suggestions are advisory — never auto-apply without user confirmation.
Confidence thresholds: only show suggestions with confidence >= 0.5.
Git history analysis uses the last 50 commits as a sample.
Deduplication: if a tool appears in both devDependencies and config signals, only one suggestion is emitted.

Error handling

No package.json → skip devDependencies analysis (not an error)
Not a git repo → skip history analysis, warn user
No profile found → use default profile, note in output
All signals empty → report "no suggestions — profile looks complete"

When to hand off

"Apply these suggestions to the profile" → edit the profile JSON

directly (phase 4 above), then suggest /nyann:doctor to verify.

"Switch to a completely different profile" → migrate-profile skill.
"Check if my repo is healthy after these changes" → doctor skill.
"What does the current profile look like?" → inspect-profile skill.

suggest— agent skill

Is suggest safe to install?

suggest — Smart Profile Suggestions

When to trigger

Execution flow

Phase 1: Detect stack and resolve profile

Phase 2: Run the suggestion engine

Phase 3: Present suggestions

Phase 4: Offer to apply

Key constraints

Error handling

When to hand off

Audit the pieces. Scan the whole. Decide.