Why this verdict
- suspicious: finding skill:.agents/skills/make-pr:.agents/skills/make-pr/SKILL.md:35:HIJACK
Security findings 1
Agent hijacking
mediumContextual risklow confidenceThe make-pr skill instructs the agent to apply the separate `make-changes` skill, whose SKILL.md is not shipped as agent-consumable content, so following this instruction would load and apply runtime instructions that no reviewer can see.
If a change file is needed or likely needed, use the `make-changes` skill instead of re-deriving that workflow here.
vector:instruction
Counter-argument considered
I tried to kill this as benign modular delegation, but the follow-up confirmed .agents/skills/make-changes/SKILL.md is NOT CONSUMED (outside every discovered agent skill, plugin, or MCP server), so the open instruction at line 35 sends the agent to apply runtime content no reviewer can inspect; no carve-out, declared claim (D1-D8), or mitigation covers applying out-of-tree skill content, and absence of the file from the consumed set never makes the instruction harmless or chain-free.
Open questions 2
What the analysis could not settle from the code alone.
[file request .agents/skills/make-changes/SKILL.md] Serve the full make-changes SKILL.md content from the repository so it can be judged for whether it stays within creating change files or steers the agent beyond that task; it was previously reported NOT CONSUMED and no content was shown.
Agent hijacking
[file request .agents/skills/make-changes/SKILL.md] The make-pr workflow directs the agent to use the make-changes skill when a release-notes change file is needed; does that skill's content stay within creating change files or does it steer the agent beyond that task?
Agent hijacking
Refuted findings 4
Candidates the review stage examined and rejected, kept for transparency.
Manipulation
highRefutedlow confidenceThe skill instructs the agent to omit Validation and Testing sections from PR bodies, concealing the change's validation status from human reviewers who rely on the PR description.
Do not include `Validation`, `Testing`, or other process sections that are already implicit in PR workflow.
Why it was refuted
Omitting Validation/Testing sections is the skill's openly declared core editorial behavior — the declared description itself says the skill 'avoids redundant sections like validation/testing' and the body presents it as a labeled 'Exclude redundant sections' step of its sparse, high-signal drafting capability — so it is neither harmful manipulation nor concealment from reviewers.
Manipulation
highRefutedmedium confidenceThe make-pr skill instructs the agent, after enumerating remix-run org team membership and token scopes, to automatically reassign any qualifying PR it created to a remix-developers team member and add it to the Remix Roadmap project via gh, modifying PR and project state beyond the declared create-a-PR purpose without per-run user confirmation.
Assign the `remix-developers` team member author with `gh pr edit <pr-url> --add-assignee <author-login>`
Why it was refuted
The assignment, project add, and status edit are openly declared conditional workflow steps ('Add Remix developer PRs to the roadmap', declared claims D7/D8) gated by an origin check, a team-membership check, and failure reporting, so the behavior is declared rather than an undeclared state change beyond the skill's purpose.
Privilege escalation
highRefutedmedium confidenceThe workflow instructs the agent to have the user run `gh auth refresh -h github.com -s project` when the project scope is absent, expanding the user's gh token with write-capable project OAuth scope so the skill can add the created PR to the Remix Roadmap board and edit its status.
If it is missing, skip the project commands and report that `gh auth refresh -h github.com -s project` is needed.
Why it was refuted
The workflow never has the agent expand the token: it first checks for the scope and, when missing, skips the project commands and only reports that `gh auth refresh` is needed, leaving execution to the user — the quoted line is itself the mitigation, and the check-and-report behavior is openly declared (D5/D6).
Reconnaissance
mediumRefutedmedium confidenceAfter creating a PR in remix-run/remix, the skill workflow instructs the agent to enumerate remix-run org team membership and, for members, edit PR assignees and write to the Remix Roadmap project board, plus check and report a needed gh project OAuth scope — automation beyond the declared task of drafting and creating a PR with a clear description.
Get the current members of the `remix-run/remix-developers` team with `gh api orgs/remix-run/teams/remix-developers/members --paginate --jq '.[].login'`
Why it was refuted
The team lookup, assignment, project add, and scope check are openly declared conditional steps of the skill's own workflow (declared claims D2-D8; the request reports no undeclared residue or contradictions), so the 'automation beyond the declared task' characterization fails the undeclared gate; the enumeration is a read-only in-org query gating an optional step with explicit skip conditions.
Coverage gaps 5
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
demos/bookstore/public/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
demos/sse/public/favicon.ico
context:unanalyzable_binary binary content is only byte-scanned
docs/api/public/favicon.ico
context:archive_unreadable ReadError: unexpected end of data
packages/tar-parser/test/fixtures/incomplete.tar
context:manifest_unparseable yaml: YAML node count exceeds 20000
pnpm-lock.yaml
