{ "skill": { "name": "writing-skills", "source": "skills/writing-skills", "scanned_at": "2026-08-28T03:35:38.717325+00:00" }, "risk_assessment": { "score": 89, "severity": "CRITICAL", "recommendation": "DO_NOT_INSTALL", "max_issue_severity": "HIGH" }, "components": [ { "path": "SKILL.md", "type": "markdown", "lines": 679, "executable": false, "size_bytes": 26360, "source_url": null, "source_identity": null, "source_digest": null }, { "path": "anthropic-best-practices.md", "type": "markdown", "lines": 1150, "executable": false, "size_bytes": 46197, "source_url": null, "source_identity": null, "source_digest": null }, { "path": "examples/CLAUDE_MD_TESTING.md", "type": "markdown", "lines": 189, "executable": false, "size_bytes": 5423, "source_url": null, "source_identity": null, "source_digest": null }, { "path": "graphviz-conventions.dot", "type": "other", "lines": 172, "executable": false, "size_bytes": 5970, "source_url": null, "source_identity": null, "source_digest": null }, { "path": "persuasion-principles.md", "type": "markdown", "lines": 187, "executable": false, "size_bytes": 5901, "source_url": null, "source_identity": null, "source_digest": null }, { "path": "render-graphs.js", "type": "javascript", "lines": 169, "executable": true, "size_bytes": 4968, "source_url": null, "source_identity": null, "source_digest": null }, { "path": "testing-skills-with-subagents.md", "type": "markdown", "lines": 384, "executable": false, "size_bytes": 12558, "source_url": null, "source_identity": null, "source_digest": null } ], "structured_summaries": [], "issues": [ { "id": "RA1", "finding_id": "finding-f84473df4e324337b09aa076e81063b6", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "SKILL.md", "start_line": 383, "end_line": null }, "finding": "Edit skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "This applies to NEW skills AND EDITS to existing skills.\n\nWrite skill before testing? Delete it. Start over.\nEdit skill without testing? Same violation.\n\n**No exceptions:**\n- Not for \"simple additions\"", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "816ac1b44d95511ddff57773e127651c333ec42f888ae313d9a40e0c5084ea8e", "occurrences": [ { "file": "SKILL.md", "start_line": 383, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-893f31050c424b378c6622aa363f7df1", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "anthropic-best-practices.md", "start_line": 5, "end_line": null }, "finding": "write Skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "\n> Learn how to write effective Skills that agents can discover and use successfully.\n\nGood Skills are concise, well-structured, and tested with real usage. This guide provides practical authoring decisions to help you write Skills that agents can discover and use effectively.\n\nFor conceptual background on how Skills work, see the [Skills overview](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview).\n", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "d3d1df715fa69a79750b2e473493c486f496d697ec663eb03cf4b3890ebb121a", "occurrences": [ { "file": "anthropic-best-practices.md", "start_line": 5, "end_line": null } ] }, { "id": "AS1", "finding_id": "finding-6c3b016e0b2741caa069c4f8c7b607d5", "category": "Agent Snooping", "pattern": "Agent Config Directory Access", "severity": "HIGH", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 85, "end_line": null }, "finding": "grep -r \"keyword\" ~/.claude/", "explanation": "Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.", "remediation": "Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variables — never read the agent's own config files.", "code_snippet": "relevant skills. You should use skills when they exist.\n\nBrowse: `ls ~/.claude/skills/`\nSearch: `grep -r \"keyword\" ~/.claude/skills/`\n```\n\n### Variant C: Claude.AI Emphatic Style", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "4a82a836d1e9f490bf284481b2505ae2a363367618429168d278bf24a6095086", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 85, "end_line": null } ] }, { "id": "AS1", "finding_id": "finding-6c3b016e0b2741caa069c4f8c7b607d5", "category": "Agent Snooping", "pattern": "Agent Config Directory Access", "severity": "HIGH", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 95, "end_line": null }, "finding": "grep -r \"keyword\" ~/.claude/", "explanation": "Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.", "remediation": "Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variables — never read the agent's own config files.", "code_snippet": "relevant skills. You should use skills when they exist.\n\nBrowse: `ls ~/.claude/skills/`\nSearch: `grep -r \"keyword\" ~/.claude/skills/`\n```\n\n### Variant C: Claude.AI Emphatic Style", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "4a82a836d1e9f490bf284481b2505ae2a363367618429168d278bf24a6095086", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 95, "end_line": null } ] }, { "id": "AS1", "finding_id": "finding-985b8e1404564f9483d4d0f249f968b8", "category": "Agent Snooping", "pattern": "Agent Config Directory Access", "severity": "HIGH", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 123, "end_line": null }, "finding": "grep -r \"symptom\" ~/.claude/", "explanation": "Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.", "remediation": "Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variables — never read the agent's own config files.", "code_snippet": "\n1. **Before starting:** Check for relevant skills\n - Browse: `ls ~/.claude/skills/`\n - Search: `grep -r \"symptom\" ~/.claude/skills/`\n\n2. **If skill exists:** Read it completely before proceeding\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "a236ff6114de9223a1b6fb8d94be4399c863736560364f5ab17ac5d18f55e08a", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 123, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-16d62d507fda45b9a7746eae9c28ad0b", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "testing-skills-with-subagents.md", "start_line": 9, "end_line": null }, "finding": "write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "\n**Testing skills is just TDD applied to process documentation.**\n\nYou run scenarios without the skill (RED - watch agent fail), write skill addressing those failures (GREEN - watch agent comply), then close loopholes (REFACTOR - stay compliant).\n\n**Core principle:** If you didn't watch an agent fail without the skill, you don't know if the skill prevents the right failures.\n", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "be76aa3b8ee8ba0091b45db5ceb2fe4088a26078a5f1429d11667e608c128e95", "occurrences": [ { "file": "testing-skills-with-subagents.md", "start_line": 9, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-da513f0f2e774db99a6ad8861c6f1abd", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "SKILL.md", "start_line": 41, "end_line": null }, "finding": "Write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "|-----------|---------------|-------------|\n| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |\n| **Verify RED** | Capture rationalizations | Document exact failures verbatim |\n| **GREEN** | Write skill | Address specific baseline failures |\n| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |\n| **REFACTOR** | Plug holes | Find new rationalizations, add counters |\n| **Stay GREEN** | Re-verify | Test again, ensure still compliant |", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "e0242b8e6d5f63893af756be8d28c64a88a6e3c8699a64f411a6f3aa3f7bba64", "occurrences": [ { "file": "SKILL.md", "start_line": 41, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-da513f0f2e774db99a6ad8861c6f1abd", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "SKILL.md", "start_line": 382, "end_line": null }, "finding": "Write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "|-----------|---------------|-------------|\n| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |\n| **Verify RED** | Capture rationalizations | Document exact failures verbatim |\n| **GREEN** | Write skill | Address specific baseline failures |\n| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |\n| **REFACTOR** | Plug holes | Find new rationalizations, add counters |\n| **Stay GREEN** | Re-verify | Test again, ensure still compliant |", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "e0242b8e6d5f63893af756be8d28c64a88a6e3c8699a64f411a6f3aa3f7bba64", "occurrences": [ { "file": "SKILL.md", "start_line": 382, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-da513f0f2e774db99a6ad8861c6f1abd", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "SKILL.md", "start_line": 567, "end_line": null }, "finding": "Write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "|-----------|---------------|-------------|\n| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |\n| **Verify RED** | Capture rationalizations | Document exact failures verbatim |\n| **GREEN** | Write skill | Address specific baseline failures |\n| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |\n| **REFACTOR** | Plug holes | Find new rationalizations, add counters |\n| **Stay GREEN** | Re-verify | Test again, ensure still compliant |", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "e0242b8e6d5f63893af756be8d28c64a88a6e3c8699a64f411a6f3aa3f7bba64", "occurrences": [ { "file": "SKILL.md", "start_line": 567, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-da513f0f2e774db99a6ad8861c6f1abd", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "testing-skills-with-subagents.md", "start_line": 36, "end_line": null }, "finding": "Write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "|-----------|---------------|-------------|\n| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |\n| **Verify RED** | Capture rationalizations | Document exact failures verbatim |\n| **GREEN** | Write skill | Address specific baseline failures |\n| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |\n| **REFACTOR** | Plug holes | Find new rationalizations, add counters |\n| **Stay GREEN** | Re-verify | Test again, ensure still compliant |", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "e0242b8e6d5f63893af756be8d28c64a88a6e3c8699a64f411a6f3aa3f7bba64", "occurrences": [ { "file": "testing-skills-with-subagents.md", "start_line": 36, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-da513f0f2e774db99a6ad8861c6f1abd", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "testing-skills-with-subagents.md", "start_line": 84, "end_line": null }, "finding": "Write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "|-----------|---------------|-------------|\n| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |\n| **Verify RED** | Capture rationalizations | Document exact failures verbatim |\n| **GREEN** | Write skill | Address specific baseline failures |\n| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |\n| **REFACTOR** | Plug holes | Find new rationalizations, add counters |\n| **Stay GREEN** | Re-verify | Test again, ensure still compliant |", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "e0242b8e6d5f63893af756be8d28c64a88a6e3c8699a64f411a6f3aa3f7bba64", "occurrences": [ { "file": "testing-skills-with-subagents.md", "start_line": 84, "end_line": null } ] }, { "id": "RA1", "finding_id": "finding-da513f0f2e774db99a6ad8861c6f1abd", "category": "Rogue Agent", "pattern": "Self-Modification", "severity": "HIGH", "confidence": 0.85, "location": { "file": "testing-skills-with-subagents.md", "start_line": 364, "end_line": null }, "finding": "Write skill", "explanation": "Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.", "remediation": "Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.", "code_snippet": "|-----------|---------------|-------------|\n| **RED** | Baseline test | Run scenario WITHOUT skill, watch agent fail |\n| **Verify RED** | Capture rationalizations | Document exact failures verbatim |\n| **GREEN** | Write skill | Address specific baseline failures |\n| **Verify GREEN** | Pressure test | Run scenario WITH skill, verify compliance |\n| **REFACTOR** | Plug holes | Find new rationalizations, add counters |\n| **Stay GREEN** | Re-verify | Test again, ensure still compliant |", "intent": null, "tags": [ "Rogue Agent" ], "evidence": {}, "match_fingerprint": "e0242b8e6d5f63893af756be8d28c64a88a6e3c8699a64f411a6f3aa3f7bba64", "occurrences": [ { "file": "testing-skills-with-subagents.md", "start_line": 364, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-e6016b27ce4d4f35bbcff4332862afdb", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "SKILL.md", "start_line": 12, "end_line": null }, "finding": "ls live in your runtime's skills directory** (`~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "\n**Writing skills IS Test-Driven Development applied to process documentation.**\n\n**Personal skills live in your runtime's skills directory** (`~/.claude/skills/` on Claude Code) — see [codex-tools.md](../using-superpowers/references/codex-tools.md) or [gemini-tools.md](../using-superpowers/references/gemini-tools.md) for the path on those runtimes. Codex, Copilot CLI, and Gemini CLI all also recognize `~/.agents/skills/` as a cross-runtime alias.\n\nYou write test cases (pressure scenarios with subagents), watch them fail (baseline behavior), write the skill (documentation), watch tests pass (agents comply), and refactor (close loopholes).\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "5296f103fc040cb60aa53dce7c5203d6f35d9dac81cc47170643696d89984032", "occurrences": [ { "file": "SKILL.md", "start_line": 12, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-08d77836fab045b2a385ac61cd05460b", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.8, "location": { "file": "SKILL.md", "start_line": 263, "end_line": null }, "finding": "skills/path/SKILL.md", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "\n**Verification:**\n```bash\nwc -w skills/path/SKILL.md\n# getting-started workflows: aim for <150 each\n# Other frequently-loaded: aim for <200 total\n```", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "3bb8c352c210acc42fcb062716095911a2ddfa2c2e13430150284e8298e38aed", "occurrences": [ { "file": "SKILL.md", "start_line": 263, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-d68b57d6c47943fab500c066081e3c49", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 73, "end_line": null }, "finding": "ls at `~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "```markdown\n## Skills Library\n\nYou have access to skills at `~/.claude/skills/`. Consider\nchecking for relevant skills before working on tasks.\n```\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "864daf7aa96e564918f393028c04951021dddf534b1044b79d825a0728adcefd", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 73, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-614000347b364a7197bc6e54e5144d62", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 84, "end_line": null }, "finding": "ls ~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "Before working on any task, check `~/.claude/skills/` for\nrelevant skills. You should use skills when they exist.\n\nBrowse: `ls ~/.claude/skills/`\nSearch: `grep -r \"keyword\" ~/.claude/skills/`\n```\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "89bbc02f0194c240d4ef23c88f7a7fca508b8e000bf201e7376c4bfa7710cb16", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 84, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-614000347b364a7197bc6e54e5144d62", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 94, "end_line": null }, "finding": "ls ~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "Before working on any task, check `~/.claude/skills/` for\nrelevant skills. You should use skills when they exist.\n\nBrowse: `ls ~/.claude/skills/`\nSearch: `grep -r \"keyword\" ~/.claude/skills/`\n```\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "89bbc02f0194c240d4ef23c88f7a7fca508b8e000bf201e7376c4bfa7710cb16", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 94, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-614000347b364a7197bc6e54e5144d62", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 107, "end_line": null }, "finding": "ls ~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "Before working on any task, check `~/.claude/skills/` for\nrelevant skills. You should use skills when they exist.\n\nBrowse: `ls ~/.claude/skills/`\nSearch: `grep -r \"keyword\" ~/.claude/skills/`\n```\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "89bbc02f0194c240d4ef23c88f7a7fca508b8e000bf201e7376c4bfa7710cb16", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 107, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-9508521b9ff743cead878ef11fa6257d", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 91, "end_line": null }, "finding": "ls\nis at `~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "### Variant C: Claude.AI Emphatic Style\n```xml\n\nYour personal library of proven techniques, patterns, and tools\nis at `~/.claude/skills/`.\n\nBrowse categories: `ls ~/.claude/skills/`", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "03ee5b9206b790411e9b13a374bfbe548bf4a1e378f3ea87362b381bb8e903bf", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 91, "end_line": null } ] }, { "id": "AS3", "finding_id": "finding-003caea0d85f4ed7885f54a9d69eeb85", "category": "Agent Snooping", "pattern": "Skill Enumeration", "severity": "MEDIUM", "confidence": 0.85, "location": { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 121, "end_line": null }, "finding": "ls\n - Browse: `ls ~/.claude/skills", "explanation": "Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.", "remediation": "Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.", "code_snippet": "\nYour workflow for every task:\n\n1. **Before starting:** Check for relevant skills\n - Browse: `ls ~/.claude/skills/`\n - Search: `grep -r \"symptom\" ~/.claude/skills/`\n", "intent": null, "tags": [ "Agent Snooping" ], "evidence": {}, "match_fingerprint": "9a171a7889211c9edb73af1cb7ee803ef11dff3a15ceb156aecd2c66b23089f5", "occurrences": [ { "file": "examples/CLAUDE_MD_TESTING.md", "start_line": 121, "end_line": null } ] } ], "suppressed_count": 0, "suppressed": [], "metadata": { "has_executable_scripts": true, "skillspector_version": "2.10.0", "llm_requested": false, "llm_available": false, "meta_analysis_applied": false, "inference_usage": [], "filtering_mode": "heuristic" }, "execution_successful": true, "analysis_completeness": { "total_components": 7, "scanned_components": 7, "coverage_percent": 100.0, "is_complete": false, "status": "partial", "execution_successful": true, "fully_inspected_files": 7, "partially_inspected_files": 0, "entirely_uninspected_files": 0, "ledger_exceptions": [ { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 59, "end_line": 59, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 96, "end_line": 96, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 122, "end_line": 122, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 123, "end_line": 123, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 190, "end_line": 190, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 193, "end_line": 193, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 204, "end_line": 204, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 263, "end_line": 263, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 285, "end_line": 285, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 286, "end_line": 286, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 329, "end_line": 329, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 330, "end_line": 330, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 399, "end_line": 399, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 431, "end_line": 431, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 433, "end_line": 433, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 465, "end_line": 465, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 634, "end_line": 634, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 637, "end_line": 637, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 639, "end_line": 639, "fatal": false }, { "outcome": "partial", "phase": "reference_resolution", "reason_code": "reference_unresolved", "message": "A local path-like reference could not be resolved unambiguously.", "path": "SKILL.md", "start_line": 645, "end_line": 645, "fatal": false } ], "scope_exclusions": [], "analyzer_statuses": [ { "analyzer_id": "artifact_integrity", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "behavioral_ast", "status": "not_applicable", "planned_work": 0, "completed": 0, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0, "reason_code": "no_applicable_files", "message": "No files matched this analyzer's applicability contract." }, { "analyzer_id": "behavioral_taint_tracking", "status": "not_applicable", "planned_work": 0, "completed": 0, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0, "reason_code": "no_applicable_files", "message": "No files matched this analyzer's applicability contract." }, { "analyzer_id": "mcp_least_privilege", "status": "completed", "planned_work": 2, "completed": 2, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "mcp_rug_pull", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "mcp_tool_poisoning", "status": "completed", "planned_work": 1, "completed": 1, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "meta_analyzer", "status": "disabled", "planned_work": 0, "completed": 0, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0, "reason_code": "disabled_by_configuration", "message": "Analyzer was disabled by the requested configuration." }, { "analyzer_id": "static_patterns_agent_snooping", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_anti_refusal", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_data_exfiltration", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_deserialization", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_excessive_agency", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_harmful_content", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_memory_poisoning", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_output_handling", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_privilege_escalation", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_prompt_injection", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_rogue_agent", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_ssrf", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_supply_chain", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_system_prompt_leakage", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_patterns_tool_misuse", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 }, { "analyzer_id": "static_yara", "status": "completed", "planned_work": 7, "completed": 7, "partial": 0, "skipped": 0, "failed": 0, "unaccounted": 0 } ], "references": [ { "source_path": "SKILL.md", "line": 12, "column": 121, "evidence": " skills directory** (`~/.claude/skills/` on Claude Code) — see [codex-tools.md](../using-superpowers/references/codex-tools.md) or [gemini-tools.md](../using-su", "target_path": null, "status": "rejected", "disposition": "out_of_scope" }, { "source_path": "SKILL.md", "line": 12, "column": 190, "evidence": "-tools.md](../using-superpowers/references/codex-tools.md) or [gemini-tools.md](../using-superpowers/references/gemini-tools.md) for the path on those runtimes.", "target_path": null, "status": "rejected", "disposition": "out_of_scope" }, { "source_path": "SKILL.md", "line": 59, "column": 52, "evidence": "- Mechanical constraints (if it's enforceable with regex/validation, automate it—save documentation for judgment calls)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 96, "column": 55, "evidence": "- Two required fields: `name` and `description` (see [agentskills.io/specification](https://agentskills.io/specification) for all supported fields)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 96, "column": 85, "evidence": "- Two required fields: `name` and `description` (see [agentskills.io/specification](https://agentskills.io/specification) for all supported fields)", "target_path": null, "status": "rejected", "disposition": "out_of_scope" }, { "source_path": "SKILL.md", "line": 122, "column": 22, "evidence": "## Core Pattern (for techniques/patterns)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 123, "column": 1, "evidence": "Before/after code comparison", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 190, "column": 33, "evidence": "description: Use when tests use setTimeout/sleep and are flaky", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 193, "column": 75, "evidence": "description: Use when tests have race conditions, timing dependencies, or pass/fail inconsistently", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 204, "column": 14, "evidence": "- Synonyms: \"timeout/hang/freeze\", \"cleanup/teardown/afterEach\"", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 204, "column": 37, "evidence": "- Synonyms: \"timeout/hang/freeze\", \"cleanup/teardown/afterEach\"", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 263, "column": 7, "evidence": "wc -w skills/path/SKILL.md", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 285, "column": 15, "evidence": "- ❌ Bad: `See skills/testing/test-driven-development` (unclear if required)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 286, "column": 12, "evidence": "- ❌ Bad: `@skills/testing/test-driven-development/SKILL.md` (force-loads, burns context)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 316, "column": 6, "evidence": "See `graphviz-conventions.dot` in this directory for graphviz style rules.", "target_path": "graphviz-conventions.dot", "status": "resolved", "disposition": "analyzed" }, { "source_path": "SKILL.md", "line": 318, "column": 46, "evidence": "**Visualizing for your human partner:** Use `render-graphs.js` in this directory to render a skill's flowcharts to SVG:", "target_path": "render-graphs.js", "status": "resolved", "disposition": "analyzed" }, { "source_path": "SKILL.md", "line": 320, "column": 1, "evidence": "./render-graphs.js ../some-skill # Each diagram separately", "target_path": "render-graphs.js", "status": "resolved", "disposition": "analyzed" }, { "source_path": "SKILL.md", "line": 320, "column": 20, "evidence": "./render-graphs.js ../some-skill # Each diagram separately", "target_path": null, "status": "rejected", "disposition": "out_of_scope" }, { "source_path": "SKILL.md", "line": 321, "column": 1, "evidence": "./render-graphs.js ../some-skill --combine # All diagrams in one SVG", "target_path": "render-graphs.js", "status": "resolved", "disposition": "analyzed" }, { "source_path": "SKILL.md", "line": 321, "column": 20, "evidence": "./render-graphs.js ../some-skill --combine # All diagrams in one SVG", "target_path": null, "status": "rejected", "disposition": "out_of_scope" }, { "source_path": "SKILL.md", "line": 329, "column": 24, "evidence": "- Testing techniques → TypeScript/JavaScript", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 330, "column": 22, "evidence": "- System debugging → Shell/Python", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 399, "column": 34, "evidence": "### Discipline-Enforcing Skills (rules/requirements)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 431, "column": 50, "evidence": "**Success criteria:** Agent correctly identifies when/how to apply pattern", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 433, "column": 23, "evidence": "### Reference Skills (documentation/APIs)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 465, "column": 3, "evidence": "| Skips/violates a rule under pressure (knows better, does it anyway) | Prohibition + rationalization table + red flags (see Bulletproofing below) | Soft guidan", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 587, "column": 65, "evidence": "**Testing methodology:** See [testing-skills-with-subagents.md](testing-skills-with-subagents.md) for the complete testing methodology:", "target_path": "testing-skills-with-subagents.md", "status": "resolved", "disposition": "analyzed" }, { "source_path": "SKILL.md", "line": 634, "column": 28, "evidence": "- [ ] Identify patterns in rationalizations/failures", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 637, "column": 52, "evidence": "- [ ] Name uses only letters, numbers, hyphens (no parentheses/special chars)", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 638, "column": 98, "evidence": "- [ ] YAML frontmatter with required `name` and `description` fields (max 1024 chars; see [spec](https://agentskills.io/specification))", "target_path": null, "status": "rejected", "disposition": "out_of_scope" }, { "source_path": "SKILL.md", "line": 639, "column": 67, "evidence": "- [ ] Description starts with \"Use when...\" and includes specific triggers/symptoms", "target_path": null, "status": "missing", "disposition": "partial" }, { "source_path": "SKILL.md", "line": 645, "column": 136, "evidence": "ed against a no-guidance control (5+ reps, every flagged match read manually) — N/A for pure reference skills", "target_path": null, "status": "missing", "disposition": "partial" } ], "limitations": [], "findings_before_filtering": 20, "findings_after_filtering": 20 } }