Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed hands-off coding workflow that can edit a working tree and use other skills, but it is task-scoped and leaves publishing decisions to the user.
Use this only when you intentionally want a hands-off coding run on a well-defined task. Review the final diff and report before shipping, keep dangerous permission bypasses to disposable or sandboxed environments, and be aware it may read and invoke installed local skills that match its routing table.
Referenced artifact was not completely inspected
ps` / `write-a-skill` | The task text IS a dependency bump, or creates/edits a `SKILL.md` → that skill's workflow is Phase 2 | One major at a time with the suit
The skill is explicitly designed for autonomous execution 'without asking,' which increases the chance of the agent making incorrect assumptions and performing unintended code or configuration changes without human confirmation. Although the skill includes some hard-stop conditions, the overall model encourages broad autonomous action across acquisition, execution, testing, and review, so mistakes can propagate farther before detection.
a destructive or irreversible step, missing access, an architectural or unimplementable
spec, or three failed fixes on one behavior. Use this skill whenever the user says
"autopilot", "/autopilot", "run task <id> autonomously", "work this task end to end
without asking", "full autonomy on this", "do the whole task, skip commits and PR", or
launches a headless run with a task id — even if they don't name the skill. Not for
interactive plan approval (task-executor), a queue of tasks (goal-runner), or when
commits or PRs should be created (create-pr).
The usage examples normalize hands-off operation with no mid-run questions, which can suppress critical clarification in ambiguous tasks and lead to unsafe modifications being treated as reversible assumptions. In an autonomous coding skill, that increases operational risk because the agent can alter code, tests, branches, and local artifacts before a human notices a misinterpretation.
## When to use this skill
- "autopilot task 12345" / "run task 12345 autonomously" / "/autopilot 12345"
- "work this end to end without asking me anything, skip PR and commits"
- A headless (`claude -p`) invocation naming a work item or task description.
Do **not** use when the user wants to approve the plan (`task-executor`), has a queue of tasks (`goal-runner`), or wants a commit or PR produced (`create-pr`).
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- ❌ "Assumed camelCase keys — matches project conventions." (no instance cited)
- ✅ "Assumed camelCase keys — every DTO in `src/api/dto/` uses them (`UserDto.ts:12`). Blast radius: one serializer line."
2. **Hard stops only.** Halt and report (never improvise) when the next step is destructive or hard to reverse (data deletion, force push, dropping schema objects, external side effects); access or credentials are missing; the task is architectural (Phase 0); every reading of the task contradicts the codebase expensively; or three fixes have failed on one behavior. The stop-vs-assume test: *would a wrong guess destroy data, publish something, or cost more to undo than redoing the task?* No → assume and log. Yes → hard stop, with the tree left at the last observed-green state and the one decision needed to resume.
3. **Never commit, push, or create PRs.** The deliverable is a verified working tree plus the report. The human gets the final gate.
4. **Scope is the task, exactly.** Adjacent problems go in "Found along the way", never in the diff.
- ❌ Adding a `-j` alias because "it's consistent" when the task said `--json`. ✅ `--json` only; the alias idea goes in Found along the way.
5. **Unobserved is `not run`, never `passed`.** Every Evidence line carries a tag: `verified` (you ran it and quote the output), `inferred` (follows from a named verified fact), `assumed` (unverified; name what breaks if wrong). "Tests pass" is not "requirements met".
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
6. **A present skill is mandatory.** For every routing row whose predicate is true, run the probe; a hit means you open that SKILL.md with the Read tool and follow it. The fallback is legal only when the probe finds nothing, and "the diff is small" never skips a skill — the skill's own body decides how much ceremony a small diff gets. **`used` is an evidence claim:** the Skills used row quotes the heading of the section you applied, which you cannot do without opening the file. A present skill you did not open is `skipped`, and one `skipped` row caps the Outcome at `done-with-caveats: skipped <skill>`.
- ❌ "code-review is for bigger diffs; I did a focused self-review instead." (present, predicate true, skipped)
- ❌ "task-executor — used (inspection discipline)" with no file opened — you know its name, not its rules; that row is `skipped`.
- ✅ "code-review present → Read `skills/code-review/SKILL.md` → applied 'When to convene the council' → single-pass; 0 blockers."
## Skill routing table
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## Skill routing table
**Probe** (run it, quote the result): `ls skills/<name>/SKILL.md .claude/skills/<name>/SKILL.md ~/.claude/skills/<name>/SKILL.md 2>/dev/null`. Any path printed, or the Skill tool listing the name → present. Nothing → absent → fallback column, marked `absent` in the report. Where a row names two skills, pick by its predicate.
| Phase | Skill | Use it when (observable predicate) | If absent |
|---|---|---|---|
The report template and required verbatim headings at L107-L141 force outputs such as 'Outcome', 'Requirements', 'What changed', and specific status words like 'done-with-caveats' and 'hard-stopped'. This imposes a specific language on users without opt-in or a documented reason for the locale constraint.
The example reinforces a pattern of end-to-end autonomous execution from work-item intake through implementation and review, which can create over-trust in agent-driven changes and reduce human oversight at key decision points. In practice, this can lead to unintended edits, incomplete requirement interpretation, or unsafe fixes being applied automatically, especially in complex repositories.
## Examples
- **Headless work item.** "autopilot task 4711" → remote is `dev.azure.com` → `azure-devops` pulls #4711 with two screenshots (both viewed); baseline `47 passed` quoted; 4 increments, each red-then-green under `write-tests`; the diff adds an endpoint → `code-review`, `security-review`, `api-contract-review`, `ship-it` run, one blocker (missing authz) fixed and re-reviewed; report has Requirements 5/5 met, a Skills used table with quoted headings, 2 cited assumptions, a `conventional-commits` block. No commits.
- **Hard stop done right.** "run task 8912 end to end without asking" → task says "remove the legacy sync"; inspection shows production traffic still hitting it (log timestamps quoted). Destructive and contradicts the spec → hard stop after Phase 1, tree untouched, report names the one decision ("confirm the consumer at X is decommissioned").
## Anti-patterns
L054 directs the agent to write objective, progress, decisions, and next step to .claude/handoffs/, which is a file-writing operation affecting the user's workspace. The markdown describes autonomous execution broadly, but it does not explicitly warn the user that the skill may create or update handoff files as part of its run.
No suspicious patterns detected.