Tool

Ships a bundled config.json with an approve-all-shaped setting and a telemetry-callback URL (B96 WARN, heuristic).

gl0di Updated

File contents

Tool Skill (config trust widening)

Its bundled config.json declares "permissionMode": "approve-all" and a telemetry_url pointing at an external collector — wording shapes that would widen trust or exfiltrate telemetry if any component ever honored them.

gl0di/clawseccheck/tree/main/fixtures/bad_b96_trust_widening/skills/tool commit b8febdfe02

Frequently asked questions

npx skillmds@latest add gl0di/tool