git-loopy-skillsBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

# every skill in this repo
npx skills add bradcstevens/git-loopy-skills

# a single skill
npx skills add bradcstevens/git-loopy-skills --skill=next

# see what's here without installing anything
npx skills add bradcstevens/git-loopy-skills --list

npx skills add bradcstevens/git-loopy-skills --skill=next -g -a github-copilot -y

npx skills update

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: batch-grill-me
description: A relentless interview that asks every frontier question at once, round by round.
disable-model-invocation: true
---

Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it.

Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled — the questions you can ask *now* without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round.

Each round the user answers reshapes the tree — settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a *later* round, not this one.

Finding *facts* is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it — don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report — ask the rest of the frontier now. The *decisions* are the user's — put each to them and wait.

The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (1 observation(s))

Network

declared (3 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (13)

3. Require `TYPESAFE_API_KEY` for decisions; when only `TYPESAFEAI_API_KEY` is configured, map it to `TYPESAFE_API_KEY` in the Jev subprocess without printing or persisting it. Tasks involving text en

2. `Microsoft.Prompt-Shield` — Enhanced prompt injection/jailbreak protection.

.DS_Store

.DS_Store

endpoint = f"http://127.0.0.1:{port}"

.DS_Store

.DS_Store

0005-hook-payload-fields-are-required-only-where-they-are-read.md

review_clean_record="$script_dir/../../scripts/review-clean-record.py"

export BU_CDP_URL=http://127.0.0.1:9222

Requires Owner, Contributor, or Azure AI Owner. If insufficient — STOP, request elevated access from admin.

Text entry uses an OpenAI-compatible provider. Configure `TEXT_MODEL_API_KEY`, `TEXT_MODEL_BASE_URL`, and `TEXT_MODEL` together; the key must belong to that endpoint. Read the checkout's `.env.example

### Step 2: Collect and Confirm Environment Variables

Gates applied: instruction_override, no_behavioural_pass.