Skip to content
skillsafebeta
← Report library
Purpose / Other

Grilling Skill Security Audit

What the author says it does (original text)

Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.

Independent security check

Security risks found

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Environment lookup and automatic sub-agent dispatch can widen access to sensitive files

Source references: 1
What we found

The Skill says to look up every fact available from the environment and explicitly dispatch a sub-agent, but sets no limits on directories, file types, sensitive information, or prior user consent.

Why this matters

If a question can be answered from workspace files, configuration, or tool state, the agent and a sub-agent may read unrelated material containing credentials, customer data, or confidential business information. The shown files do not direct external transmission, but delegation increases the number of agent contexts exposed to the material.

What this evidence establishes

Line 26 requires looking up environmental facts and delegating that lookup, without defining directory or sensitive-file boundaries, so it could broaden what environment data is read and shared between agents. However, it only calls for facts needed by the current question; it does not direct credential access, broad filesystem searches, or external transmission. The actual risk depends on runtime permissions and the task. Users can ask for explicit scope, excluded sensitive paths, and confirmation before sensitive reads.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:26In the instructionsOpen original file
Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now. The _decisions_ are the user's: put each to them and wait.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Mandatory sub-agent dispatch bypasses per-task user control over delegation scope

Source references: 2
What we found

Whenever an environmental fact is needed, the instruction mandates dispatching a sub-agent. It does not make delegation optional or require disclosure and approval of what that agent will access.

Why this matters

On a platform where sub-agents inherit tools or workspace access, an ordinary planning discussion can expand into additional agent activity, making it harder for the user to track which actor is inspecting which resources.

Line 26 makes sub-agent dispatch mandatory and does not require disclosing the delegation scope or obtaining per-delegation consent. A user therefore may not control, before each handoff, which task and environmental facts another agent receives. The instruction is limited to finding prerequisite facts and grants no extra permissions or external communication; actual access remains constrained by the host. Users can require delegation to be opt-in and demand the target, data scope, and permissions before approval.

SKILL.md:26In the instructionsOpen original file
Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now. The _decisions_ are the user's: put each to them and wait.
Show 1 other places
SKILL.md:28In the instructionsOpen original file
The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

“Relentless” questioning plus recommended answers can create fatigue and decision anchoring

Source references: 3
What we found

The Skill repeatedly calls for exhaustive questioning and requires its own recommended answer for every question. Completion depends on visiting every branch, rather than on the user deciding that enough information has been gathered or choosing to stop.

Why this matters

For a complex plan, the user may face many successive questions and accept suggested choices through fatigue. The recommendations may also anchor commercial, permission, or risk decisions toward the agent's preferred answer.

These are active interaction rules: the Skill calls for relentless interviewing, a recommended answer for every question, and completion only after every branch is visited. Repeated recommendations can anchor the user's judgment, while the empty-frontier stopping rule can cause fatigue. It does require waiting for answers and confirmation before acting, so it does not itself execute decisions for the user. Users can request an explicit stop option, a round limit, and recommendations shown only after their initial answers.

SKILL.md:6In the instructionsOpen original file
Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it.Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled: the questions you can ask _now_ without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round.
Show 2 other places
SKILL.md:28In the instructionsOpen original file
The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.
SKILL.md:24In the instructionsOpen original file
Each round the user answers reshapes the tree: settled decisions push the frontier outward and unblock questions that depended on them. Recompute the frontier and ask the next round. A question whose answer depends on another question still open in this round belongs to a _later_ round, not this one.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

0 instruction sections

The Skill turns a user's plan or decision into a decision tree and asks, round by round, every question currently considered answerable; it also supplies its own recommended answer for each question.

View source
SKILL.md:6In the instructionsOpen original file
Interview the user relentlessly until you reach a shared understanding. Map this as a **design tree**: every decision branches into the decisions that hang off it.Work the tree in **rounds**. The **frontier** is every decision whose prerequisites are already settled: the questions you can ask _now_ without guessing at answers you haven't heard yet. Ask the whole frontier in one round: number each question and give your recommended answer. Then wait for the user's answers before the next round.

When a question requires facts from the environment, the Skill instructs the agent to investigate and dispatch a sub-agent instead of asking the user; dependent questions wait while other questions continue.

View source
SKILL.md:26In the instructionsOpen original file
Finding _facts_ is your job, never the user's. When a frontier question needs a fact from the environment (filesystem, tools, etc.), dispatch a sub-agent to find it; don't ask the user for anything you could look up yourself. Don't block on it: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now. The _decisions_ are the user's: put each to them and wait.

The Skill explicitly says not to act on the plan until every decision branch has been covered and the user confirms shared understanding.

View source
SKILL.md:28In the instructionsOpen original file
The session is done when the frontier is empty: every branch of the design tree visited, nothing left silently assumed. Do not act on it until the user confirms you have reached a shared understanding.
Start here · InstructionsSKILL.md
grilling

The instructions have no section headings. Supporting files and code excerpts are available below.

Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
Lines read
33
File checksum (to compare versions)
7c1aab9fb5cdec80183358bbf79c4fd5242e5d210d3cf48e2c1ca5436deb92d6