Asking Until 100%

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:08 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed repo-aware clarification helper that reads limited project context and configuration to ask better questions before coding or build work.

Install this if you want the agent to pause and ask structured questions before ambiguous coding or build work. Expect it to read repo layout and a repo-local .asking-until-100.yaml when relevant; review or remove that config if you do not want local project preferences to shape its behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about agent behavior: increasing clarification and generating structured question reports when repository or task requirements are ambiguous. The supplied code does not implement questioning behavior, ambiguity detection, repo-aware clarification logic, or reporting for coding tasks. Instead, it is a utility script focused on explaining configuration/profile precedence and merging. Its primary purpose is materially different from the declared purpose, so this is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about a conversational protocol that improves requirement clarification before implementation. The supplied code does not implement questioning behavior, clarification logic, or structured question reports. Instead, it analyzes prompt text for project/build cues, optionally inspects a repository directory, infers a template such as web app, API service, monorepo, or delivery pipeline, and outputs a rendered directory structure. Repo awareness is present, but it is used for filesystem inspection and structure rendering rather than clarifying ambiguous tasks. This is a materially different primary purpose, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a behavioral protocol for improving clarification during software-task execution, focused on asking higher-signal questions when project context is ambiguous. The supplied code does not implement any questioning, repo-awareness, ambiguity detection, or structured question generation. Instead, it is a straightforward command-line validator for YAML config/profile files, calling load_yaml_mapping and validate_profile_data and printing validation results. This is a materially different primary purpose, so the description does not accurately represent the code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill explicitly instructs the agent to load repo-local configuration and inspect the repository, which implies file-read capability, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a host system or agent may grant broader filesystem access than users expect, increasing the chance of unintended data exposure from local files or repos.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation conditions are very broad: ambiguous coding, build, architecture, debugging, discovery, and general tasks could cover a large share of developer interactions. Overbroad triggering can cause the skill to activate in contexts where repository inspection or blocking clarification is unnecessary, increasing exposure of repo contents and creating opportunities for denial-of-service-style workflow interference or policy overshadowing.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: This manifest defines task overrides for broad categories such as "coding," "build," "architecture," "debugging," "discovery," and "general," but it does not specify how those tasks are detected or what should not trigger them. In a manifest file, the absence of explicit trigger scope or negative examples can lead to unintended invocation because these labels overlap with common user intents.

Vague Triggers

Low

• Confidence: 88% confidence
• Finding: The instruction says to use this file when the task is about broad areas like project setup, build systems, deployment, CI, packaging, or delivery. This scope is expansive and does not provide explicit trigger boundaries or exclusion examples, which could lead to unintended invocation for common engineering conversations.

Static analysis

No suspicious patterns detected.