Consent suppression in agent skills
ATR evaluates whether instructions attempt to bypass confirmations or human review.
Why it matters
Instructions can steer execution. Tool descriptions, manifests, and skill instructions are read by a model. A malicious or misleading instruction can shape which actions the model takes.
Example: one skill in forty
A large open-source workflow-automation project contains 40 skills. One of them, which manages stacked pull requests, tells the agent always to run its merge command with the flag that skips the confirmation prompt, so the agent can merge an entire stack of pull requests without asking the user. ATR reported this under ATR-P0002, consent suppression, at critical severity. None of the other 39 skills had a consent-suppression finding.
The fix is to drop that flag from the merge instruction, so the user confirms before anything is merged, and to keep non-interactive flags for read-only commands.
In the registry
ATR evaluated this on 205 skills and plugins in the 20 published reports, as of Nov. 9th, 2026, and found an issue in 8, across 4 reports.
Each report shows the exact file and lines, why the issue matters, and the recommended fix, with a fix prompt you can paste into your coding agent. Browse the reports.
Questions
What does ATR check for consent suppression?
ATR evaluates whether instructions attempt to bypass confirmations or human review. Each skill or plugin is assessed against 23 rules: 14 common, one guardrail, and eight component-specific rules.
Why does consent suppression matter?
Instructions can steer execution. Tool descriptions, manifests, and skill instructions are read by a model. A malicious or misleading instruction can shape which actions the model takes.
How often does the registry find it?
ATR evaluated this on 205 skills and plugins in the 20 published reports, as of Nov. 9th, 2026, and found an issue in 8, across 4 reports.
How do I check my own skill or plugin?
Request a scan at bluerock.io/scan. Your first scan is free. Each skill or plugin is assessed against 23 rules: 14 common, one guardrail, and eight component-specific rules.
Source: BlueRock, Component Level Security Analysis for MCP Servers, Agent Skills and Plugins (Oct. 22nd, 2026).