Hallucinated Paths

Reply cites file paths, directories, or module locations that do not exist in the current project.

Security Scan

This is an instruction-only skill whose stated purpose (detecting and avoiding fabricated file paths) matches its instructions and it requests no credentials or installs — it is internally coherent and low-risk.

Purpose & Capability

The name and description describe detecting/avoiding hallucinated paths; the SKILL.md contains only guidance on checking filesystem layout and how to behave when paths are missing. There are no unrelated requirements (no env vars, binaries, or config paths).

Instruction Scope

Runtime instructions are narrowly scoped: they advise verifying file existence, searching the repo, and explicitly declaring when a file is new. They do not instruct reading unrelated secrets, making external network calls, or modifying other skills.

Install Mechanism

No install spec and no code files — instruction-only. Nothing will be written to disk or downloaded during install, which is lowest-risk.

Credentials

The skill requires no environment variables, credentials, or config paths. The guidance references only local filesystem checks that are appropriate for the purpose.

Persistence & Privilege

always is false and model invocation is allowed (the platform default). The skill does not request permanent presence or any elevated privileges and does not modify other skills or global settings.

Assessment

This skill is instruction-only and appears safe: it asks the agent to verify paths before using them and requests no secrets or installs. Before installing, confirm you trust the agent framework to follow the guidance (the skill contains no executable code), and be aware that autonomous invocation is the platform default — if you want tighter control, only enable the skill for manual invocation. If you need absolute assurance, review agent logs to confirm it performs the recommended filesystem checks rather than fabricating paths.

The reply references files or directories that aren't on disk. The agent invented a plausible-sounding location (e.g., src/utils/helpers.ts) because similar paths usually exist in projects like this one.

Symptoms

• A quoted path doesn't exist when you check the filesystem.
• The reply uses a path structure that matches convention but the specific file is absent (e.g., src/components/Button.tsx in a project that actually puts components elsewhere).
• Imports reference modules that cannot be resolved.
• "Edit X file at path Y" instructions fail because Y is not there.

What to do

• Before quoting a path, verify it with a real file-existence check (ls, stat, a glob search). Do not rely on memory or convention.
• When unsure where something lives, search first: grep for the symbol, glob for the filename, read the repo layout.
• If the answer requires a path that doesn't exist, say so explicitly — don't fabricate. "I couldn't find a file for X" is correct; inventing one is not.
• When proposing to create a new file, state clearly that it is new, and justify why it belongs at that path given the repo's actual conventions.
• After editing, verify the edited file is the one that exists, not a hallucinated sibling.