synopsis

[Skill Scanner] Instruction to copy/paste content into terminal detected All findings: [CRITICAL] command_injection: Instruction to copy/paste content into terminal detected (CI012) [AITech 9.1.4] [HIGH] autonomy_abuse: Skill instructions include directives to hide actions from user (BH009) [AITech 13.3] Benign overall with coherent purpose-capability alignment. The code is intended for a local, environment-bound synopsis export workflow. Risks are limited to local environment assumptions and placeholder handling; ensure proper substitution of PROJECT_PATH and restrict local API exposure to trusted contexts. LLM verification: Functionally, the skill does what it advertises: it reads local project context and git metadata, generates an HTML manager-focused synopsis, and appends it to a configured A2UI log file. There is no direct evidence of code-based malware (no obfuscated payloads, no external network communications beyond localhost). However, the default sink (a Google Drive–backed path) and the insistence on blind heredoc append operations create a realistic risk of accidental data exfiltration of repository and