CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptREADME.md· markdown

209default it binds to loopback. On a LAN bind, the auto-minted `adminToken` gates

210mutating admin endpoints; read endpoints (health, sessions, metrics, the UI)

211stay open and expose stats but never prompt content, API keys, or the

212`adminToken`.

213

Occurrences

1 occurrence · at L211

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256183eb789192b5159…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.skills/capture/SKILL.md · 1 file

.skills/capture/SKILL.md3.3 KB · Markdown

name: capture

description: Capture a REAL Claude Code /v1/messages body as a replay fixture, so the HTTP replay arm (.skills/replay) faithfully reproduces Claude Code's cache_control breakpoint structure (a hand-authored fixture makes the 1h-TTL knob look like a no-op). Starts a clawback proxy with --capture-body, drives ONE real claude turn through it via the PTY driver, verifies the dump carries cache_control breakpoints, and promotes it to the fixture path. Spends real Anthropic tokens (exactly one turn; pin a cheap model with --model). Use once before replay-based benchmarking, or to refresh the fixture when Claude Code changes its request shape.

clawback fixture capture

Run .skills/capture/scripts/capture_fixture.sh from the project root. It captures the genuine Claude Code request body end to end:

starts a standalone clawback proxy with --capture-body <tmp> (detached,

via .skills/monitor's run_monitor.sh --detach);

drives one real claude turn through it (`benchmark/bin/drive_pty.js

--turns 1`), which points claude at the proxy and types a single prompt;

stops the proxy;
verifies the dump with benchmark/bin/verify_fixture.js (must carry ≥1

cache_control breakpoint, else the 1h-TTL arm is a no-op);

promotes the temp dump to the fixture path at mode 0600.

The captured bytes are the request body only — system prompt, tools, and the one message. The Anthropic API key is not captured (it rides in headers clawback never dumps). Still, treat the fixture as sensitive: it contains your system prompt and tool definitions. It is gitignored-by-convention and excluded from the npm tarball.

Spends real tokens

Step 2 runs the real claude binary against your own Anthropic limits — exactly one turn. Pin a cheap model to keep it trivial:

.skills/capture/scripts/capture_fixture.sh --model claude-haiku-4-5-20251001

Requirements: the claude CLI on PATH, node-pty installed (npm i node-pty), and claude already authenticated.

Usage

# default: capture to benchmark/fixtures/ccode.json on 127.0.0.1:8787
.skills/capture/scripts/capture_fixture.sh --model claude-haiku-4-5-20251001

# custom destination / port / prompt:
.skills/capture/scripts/capture_fixture.sh --out benchmark/fixtures/mywork.json \
  --port 8790 --prompt "Summarize README.md in one line."

Options

--out PATH — fixture destination (default benchmark/fixtures/ccode.json).
--host, --port — proxy bind (default 127.0.0.1:8787).
--model ID — pin claude's model (cost control; forwarded to drive_pty).
--prompt TEXT — the single prompt to type (default: a read-only listing).
--keep-tmp — keep the temp dump even if verification fails (debugging).
everything after -- is forwarded to drive_pty.js.

Why this exists

--capture-body (in src/server.js) dumps the pristine body once, before clawback's strip/1h-rewrite mutations — so the fixture is exactly what Claude Code put on the wire. Replaying it through clawback then exercises the real cache mechanic. See .skills/replay.

After capture

Replay the fixture with .skills/replay, then analyze with .skills/bench and visualize with .skills/plot. For the faithful (non-replay) arm that drives real claude live, see .skills/drive.

capture— agent skill

Is capture safe to install?

clawback fixture capture

Spends real tokens

Usage

Options

Why this exists

After capture

Audit the pieces. Scan the whole. Decide.