---
category: index
bucket: footguns
generated: true
---

# Footguns Index

Generated by `goat-flow index`; do not edit by hand. Each row below maps one active footgun entry to its source file with a grep-friendly `(search: "...")` anchor. Re-run `goat-flow index` after adding, editing, renaming, or resolving entries - `goat-flow stats --check` fails while this file is stale. Live entry counts and freshness come from `goat-flow stats`.

- [Agent-produced output may contain control sequences that hijack the host terminal](agent-output-trust.md) (search: "## Footgun: Agent-produced output may contain control sequences that hijack the host terminal") - The agent runs a TUI program (`htop`, `vim`, `tmux`, `nnn`, anything with `\x1b[` escape codes) inside its sandbox.
- [Provider message shapes have hard constraints that crash on naive slicing](agent-output-trust.md) (search: "## Footgun: Provider message shapes have hard constraints that crash on naive slicing") - Code that wraps LM-provider responses crashes on edge cases the test fixtures didn't cover.
- [Audit does not prove end-to-end deny enforcement at runtime](auditor.md) (search: "## Footgun: Audit does not prove end-to-end deny enforcement at runtime") - The selected-agent audit validates hook syntax, self-test behavior, registration, and a runtime-shaped blocked Bash payload through the registered hook path.
- [The deny-mechanism runtime smoke executes the target checkout's own hook command](auditor.md) (search: "## Footgun: The deny-mechanism runtime smoke executes the target checkout's own hook command") - The runtime evidence level of the agent deny-mechanism audit does not only run goat-flow's own managed script - it executes the *target project's* configured launcher string through `bash -c`.
- [Missing directories can false-pass when harness checks use `listDir()` as an existence test](auditor.md) (search: "## Footgun: Missing directories can false-pass when harness checks use `listDir()` as an existence test") - After deleting the old WIP goat-flow install from `api-main`, `/api/audit?path=/home/hxdev/projects/feature/api-main&quality=true&fresh=true` reported setup failure `Missing:…
- [Structural Compliance Illusion](auditor.md) (search: "## Footgun: Structural Compliance Illusion") - Build checks in `src/cli/audit/check-goat-flow.ts` and `src/cli/audit/check-agent-setup.ts` prove the install shape is present, not that the cold-path docs are semantically true.
- [Learning-loop record counts have two grammars that disagree on resolved entries](auditor.md) (search: "## Footgun: Learning-loop record counts have two grammars that disagree on resolved entries") - Two surfaces show different counts under the same bucket label.
- [TTL'd cache invalidation MUST travel with every writer, not just the writer the bug surfaced from](caching.md) (search: "## Footgun: TTL'd cache invalidation MUST travel with every writer, not just the writer the bug surfaced from") - A read-side cache returns stale data after a write completes.
- [Resource cleanup at one layer leaves the consumer loop running at the next layer](cleanup-layering.md) (search: "## Footgun: Resource cleanup at one layer leaves the consumer loop running at the next layer") - A long-lived resource (container, sandbox, process, session, lock) has its own TTL or cleanup mechanism.
- [Host-native paths leak into user-visible CLI output on Windows](cli.md) (search: "## Footgun: Host-native paths leak into user-visible CLI output on Windows") - Windows users see `C:\Users\thatm\...` style backslash paths in setup prompts, audit `evidence` fields, quality `QUALITY_DIR` Bash snippets, skill scaffold output, glob results, and the…
- [ESM main-module guard breaks under symlinks](cli.md) (search: "## Footgun: ESM main-module guard breaks under symlinks") - CLI exits 0 with zero output.
- [Diagnostic logs to stdout corrupt structured-output modes](cli.md) (search: "## Footgun: Diagnostic logs to stdout corrupt structured-output modes") - A CLI command emits structured output (JSON, SARIF, JSONL, CSV) to stdout for a downstream consumer (CI parser, GitHub Code Scanning upload, jq pipeline, MCP client).
- [`value || DEFAULT` silently drops valid falsy values (0, "", false)](config.md) (search: "## Footgun: `value || DEFAULT` silently drops valid falsy values (0,") - CLI option documented as "set to 0 to disable" is silently overridden by the config default.
- [Misspelled config key silently disables the feature](config.md) (search: "## Footgun: Misspelled config key silently disables the feature") - A feature reads its configuration from a nested config object via `.get("env", {})` or `cfg.section?.field`, but the actual key in the YAML/JSON is `"environment"`.
- [`JSON.stringify` as a dedupe key silently drops function values, class instances, and BigInts](config.md) (search: "## Footgun: `JSON.stringify` as a dedupe key silently drops function values, class instances, and BigInts") - A merge or dedupe step over a list of config objects silently loses entries.
- [Project-browser modal is reachable only via header-span click, not from the add-project flow](dashboard.md) (search: "## Footgun: Project-browser modal is reachable only via header-span click, not from the add-project flow") - Users looking for a filesystem-browse capability while adding a project find only a text input.
- [Tailwind utility class names collide with custom component classes](dashboard.md) (search: "## Footgun: Tailwind utility class names collide with custom component classes") - A custom CSS rule appears correct in source but the rendered element has unexpected `box-shadow`, `border`, `outline`, or other properties that the custom rule never declares.
- [Native Windows terminal sessions need both a Windows shell plan and a Windows runner shim](dashboard.md) (search: "## Footgun: Native Windows terminal sessions need both a Windows shell plan and a Windows runner shim") - The Workspace view reports `File not found` when `Open terminal` is clicked on native Windows, even though the same runner works in WSL or a regular Windows shell.
- [Dashboard reader decoders can erase score-critical API fields](dashboard.md) (search: "## Footgun: Dashboard reader decoders can erase score-critical API fields") - The dashboard can show concern scores, metric notes, or pass/fail labels that disagree with `/api/audit`.
- [Dashboard aggregate facts and Home agent cards can use different agent sets](dashboard.md) (search: "## Footgun: Dashboard aggregate facts and Home agent cards can use different agent sets") - Home can show or hide agent cards differently from the aggregate Agent Setup scope.
- [Dashboard terminal helper tests can leak event-loop handles](dashboard.md) (search: "## Footgun: Dashboard terminal helper tests can leak event-loop handles") - A dashboard terminal helper test suite prints passing assertions but the Node test process keeps running until an outer timeout or CI job limit kills it.
- [Dashboard terminal prompts can be dropped before browser attachment](dashboard.md) (search: "## Footgun: Dashboard terminal prompts can be dropped before browser attachment") - Clicking a dashboard action such as "Run Quality Assessment in Runner" creates a Claude terminal session with the right title, but the terminal lands at Claude's empty `❯` prompt with no assessment…
- [Workspace terminal waiting state has multiple derived surfaces](dashboard.md) (search: "## Footgun: Workspace terminal waiting state has multiple derived surfaces") - The Workspace header or terminal pane can show a session waiting while the summary meters still count it as running, or an active session can briefly show "Awaiting input" and then flip back to…
- [Dashboard agent-targeting uses activeRunner where it should use the failing or selected agent](dashboard.md) (search: "## Footgun: Dashboard agent-targeting uses activeRunner where it should use the failing or selected agent") - The Home "Fix First" card shows a command like `--agent claude` but the agent with the actual failing harness check is a different agent (e.g. codex at 93%).
- [Dashboard-launched Codex must override the default restricted sandbox](dashboard.md) (search: "## Footgun: Dashboard-launched Codex must override the default restricted sandbox") - A Codex session launched from the Workspace terminal fails `bash scripts/preflight-checks.sh` even though Claude Code and a normal terminal pass.
- [Command-segment splitter must track substitution depth, not just quotes](deny-dangerous.md) (search: "## Footgun: Command-segment splitter must track substitution depth, not just quotes") - Benign reads denied as `Policy destructive: Complex command substitution`: an unquoted `$(...)` holding a control operator (`echo $(date; whoami)`, `$(grep x f || echo MISS)`) and arithmetic `$((1 +…
- [Nested hook checks must reuse the command segment splitter](deny-dangerous.md) (search: "## Footgun: Nested hook checks must reuse the command segment splitter") - Pre-fix, the hook blocked top-level `true; rm -rf /` while allowing the same command nested inside `bash -c "true; rm -rf /"` or `echo "$(true; rm -rf /)"`.
- [Heredoc masking can hide executable shell lines](deny-dangerous.md) (search: "## Footgun: Heredoc masking can hide executable shell lines") - Masking quoted heredoc bodies fixes false positives on inert report JSON/prose, but is unsafe if the masker doesn't exactly mirror Bash delimiter semantics: one that misses `<<-` tab-indented…
- [Dispatcher checks must inspect pipeline segments, not only the whole command](deny-dangerous.md) (search: "## Footgun: Dispatcher checks must inspect pipeline segments, not only the whole command") - Pre-fix, direct `xargs rm -rf < list.txt` blocked, but equivalent pipelines such as `printf '%s\n' /tmp/build-old | xargs rm -rf` or `find . -type f | xargs -r rm -rf` returned exit 0.
- [Splitting a monolithic guardrail can drop parser coverage while preserving the headline checks](deny-dangerous.md) (search: "## Footgun: Splitting a monolithic guardrail can drop parser coverage while preserving the headline checks") - A hook split looks cleaner because `patterns-shell.sh`, `patterns-paths.sh`, and `patterns-writes.sh` each block the happy-path examples (`rm -rf /`, `cat .env`, `git push`).
- [Git push deny checks must normalize shell wrappers and control bodies](deny-dangerous.md) (search: "## Footgun: Git push deny checks must normalize shell wrappers and control bodies") - A deny hook can appear to block `git push` while allowing valid shell forms that execute a push through environment wrappers, quoted assignments, `if`/`then` bodies, function bodies, or login-command…
- [GitHub CLI comments bypassed shared-system write guardrails](deny-dangerous.md) (search: "## Footgun: GitHub CLI comments bypassed shared-system write guardrails") - A model can post to GitHub through `gh issue comment ... --body-file ...` even when `git push` is blocked and the hook catches heredoc command substitution: the guardrail stops the risky shape…
- [Extension-based secret checks can confuse filenames with query syntax](deny-dangerous.md) (search: "## Footgun: Extension-based secret checks can confuse filenames with query syntax") - A secret-path hook correctly blocks `cat path/to/id_rsa.key`, but also blocks harmless jq/yq expressions such as `jq -r .key file.json` and `yq .metadata.key file.yaml`, plus text after an unquoted…
- [File-read deny does not bind Bash shell reads of secret files](deny-dangerous.md) (search: "## Footgun: File-read deny does not bind Bash shell reads of secret files") - Before the Bash-side sentinel was added, `goat-flow audit --harness` reported `deny-covers-secrets: pass` while a live Bash probe returned exit 0.
- [Copilot preToolUse hooks must distinguish structured payloads from Bash calls](deny-dangerous.md) (search: "## Footgun: Copilot preToolUse hooks must distinguish structured payloads from Bash calls") - Copilot `preToolUse` can receive Bash and non-Bash payloads through the same hook.
- [Shell substitution scanners must be quote-aware inside the substitution body](deny-dangerous.md) (search: "## Footgun: Shell substitution scanners must be quote-aware inside the substitution body") - A regex-only `$()` / `<()` scanner can stop at a `)` that appears inside a quoted string within the substitution body.
- [Path validators can treat gitignored local-state markers as missing docs](docs-and-crossrefs.md) (search: "## Footgun: Path validators can treat gitignored local-state markers as missing docs") - A clean checkout fails the harness `doc-paths-resolve` check because a committed doc mentions an intentionally gitignored local-state file.
- [Playbooks reference goat-flow repo-internal files absent from consumer installs](docs-and-crossrefs.md) (search: "## Footgun: Playbooks reference goat-flow repo-internal files absent from consumer installs") - A playbook under `workflow/skills/playbooks/` (installed to `.goat-flow/skill-docs/playbooks/`) or a skill under `workflow/skills/` (installed to `.claude/skills/`, `.agents/skills/`, etc.) cites…
- [Flipping a doctrine in one playbook leaves siblings citing the old stance](docs-and-crossrefs.md) (search: "## Footgun: Flipping a doctrine in one playbook leaves siblings citing the old stance") - A policy change in one doc passes its own review, but a sibling playbook or instruction file still encodes - and triages by - the OLD stance.
- [Adding an instruction-file section ripples across four section-list sources plus the line target](docs-and-crossrefs.md) (search: "## Footgun: Adding an instruction-file section ripples across four section-list sources plus the line target") - Adding one `## <Section>` heading to an instruction file (e.g.
- [Agent capability metadata goes stale when upstream docs add hooks](docs-and-crossrefs.md) (search: "## Footgun: Agent capability metadata goes stale when upstream docs add hooks") - Dashboard and docs can report an agent as "not supported" for hooks while the runtime has a project-local hook config or a viable fallback path.
- [Hook additions and renames cross runtime, dashboard, and audit surfaces](docs-and-crossrefs.md) (search: "## Footgun: Hook additions and renames cross runtime, dashboard, and audit surfaces") - A hook script can exist and pass its own smoke test while the dashboard registry, installer, manifest, preflight parity, audit facts, agent config templates, installed mirrors, and docs disagree…
- [Active footgun Symptoms paragraph drifts after the underlying bug is fixed](docs-and-crossrefs.md) (search: "## Footgun: Active footgun Symptoms paragraph drifts after the underlying bug is fixed") - A footgun is tagged `Status: active` and reads as a current trap.
- [Adding a skill-playbook requires lock-step updates across 13+ surfaces](docs-and-crossrefs.md) (search: "## Footgun: Adding a skill-playbook requires lock-step updates across 13+ surfaces") - A playbook appears in `workflow/skills/playbooks/` and `.goat-flow/skill-docs/playbooks/`, but one parity, audit, prompt, install, or docs surface is not enrolled.
- [Cross-reference fragility across docs](docs-and-crossrefs.md) (search: "## Footgun: Cross-reference fragility across docs") - A renamed or moved file breaks links in multiple documents.
- [ADR renumbering breaks cross-references](docs-and-crossrefs.md) (search: "## Footgun: ADR renumbering breaks cross-references") - ADR notes that say "absorbs ADR-NNN" or "supersedes ADR-NNN" can silently point at the wrong decision after ADR deletion and renumbering.
- [Version bump checks do not cover synthetic project config strings](docs-and-crossrefs.md) (search: "## Footgun: Version bump checks do not cover synthetic project config strings") - `bash scripts/bump-version.sh <version>` and `npm run check-versions` both pass, but helper scripts, integration fixtures, or secondary reference/playbook trees can still retain the previous release…
- [Hot-path agent instructions drift unevenly across agents](docs-and-crossrefs.md) (search: "## Footgun: Hot-path agent instructions drift unevenly across agents") - One agent receives weaker release or routing guidance than the others even though all four instruction files are supposed to express the same core contract.
- [Filesystem-backed validation can miss untracked or ignored replacement files](docs-and-crossrefs.md) (search: "## Footgun: Filesystem-backed validation can miss untracked or ignored replacement files") - Local validation passes, but the next commit or CI run breaks because the replacement file exists only in the working tree.
- [Prose examples for agent-specific paths drift from the manifest](docs-and-crossrefs.md) (search: "## Footgun: Prose examples for agent-specific paths drift from the manifest") - A doc lists an agent-specific path (`.agents/skills/`, `.codex/skills/`, etc.) that does not match the manifest.
- [Cold-path docs drift while structural audit passes](docs-drift.md) (search: "## Footgun: Cold-path docs drift while structural audit passes") - The CLI audit reports PASS while cold-path documentation contains false claims, wrong check descriptions, dead paths, and glossary misdirections.
- [Hook toggles can scaffold uninstalled agent surfaces](hooks.md) (search: "## Footgun: Hook toggles can scaffold uninstalled agent surfaces") - A hook toggle against a clean target created agent config and hook files for agents the target never opted into, making setup and audit state look agent-aware when the project asked only to change…
- [Hook command strings can fail before guard code starts](hooks.md) (search: "## Footgun: Hook command strings can fail before guard code starts") - Direct hook self-tests pass, but an agent session reports a PreToolUse failure with exit 126 or 127 before any `BLOCKED:` or deny JSON appears.
- [Hook sync must unignore required policy files](hooks.md) (search: "## Footgun: Hook sync must unignore required policy files") - Historical pre-fix failure: `goat-flow hooks enable deny-dangerous` or `goat-flow hooks sync` made local checks pass, but a fresh clone lacked `.goat-flow/hooks/deny-dangerous/` because stale…
- [Legacy per-agent hook launchers using --show-toplevel resolve to the worktree, not the main repo](hooks.md) (search: "## Footgun: Legacy per-agent hook launchers using --show-toplevel resolve to the worktree, not the main repo") - A Claude or Antigravity session inside a `git worktree add` checkout fails every Bash with a PreToolUse error like `bash: /path/to/repo/.claude/worktrees/<branch>/.claude/hooks/<guard>.sh: No such…
- [Hook launchers fail closed when the shell cwd is outside any git repo, wedging every Bash](hooks.md) (search: "## Footgun: Hook launchers fail closed when the shell cwd is outside any git repo, wedging every Bash") - A Claude/Antigravity session that `cd`'d outside the repo (usually `/tmp` for scratch) has EVERY later Bash blocked by `BLOCKED: Policy hook unavailable: git repository root unavailable.` (older…
- [Copilot hook config can exist while runtime policy hooks are disabled](hooks.md) (search: "## Footgun: Copilot hook config can exist while runtime policy hooks are disabled") - Goat-flow can verify `.github/hooks/hooks.json` and the deny script while Copilot never invokes the repo hook.
- [Installed settings.json deny patterns can silently drift from workflow templates](hooks.md) (search: "## Footgun: Installed settings.json deny patterns can silently drift from workflow templates") - An agent can perform an action (e.g.
- [Codex permission profiles must match the local CLI grammar](hooks.md) (search: "## Footgun: Codex permission profiles must match the local CLI grammar") - Codex warns or fails before shell startup when the profile names a workspace-root token, access value, or base-profile shape the runtime can't load.
- [Codex config preservation can leave old permission profiles behind](hooks.md) (search: "## Footgun: Codex config preservation can leave old permission profiles behind") - A normal `goat-flow install . --agent codex` upgrade refreshes skills and hook scripts but preserves an existing `.codex/config.toml`.
- [Optional hook migration must remove old registrations and re-add enabled central entries](hooks.md) (search: "## Footgun: Optional hook migration must remove old registrations and re-add enabled central entries") - The installer can successfully copy the new central hook scripts, prune legacy per-agent hook files, and still leave an existing agent hook config pointing at the deleted legacy…
- [Re-adding a removed agent tool (MultiEdit) reprints "matches no known tool" every launch](hooks.md) (search: "## Footgun: Re-adding a removed agent tool (MultiEdit) reprints") - Claude Code printed `Permission deny rule "MultiEdit(/secrets/)" matches no known tool — check for typos.` (x12) on every launch.
- [Fail-soft analyzer skips can silently uncover a configured language](hooks.md) (search: "## Footgun: Fail-soft analyzer skips can silently uncover a configured language") - A project has a root `.gruff-<lang>.yaml` config, the matching language file is edited, and the PostToolUse hook exits 0 with no output.
- [Registered Stop hooks can be dead config behind agent trust gates](hooks.md) (search: "## Footgun: Registered Stop hooks can be dead config behind agent trust gates") - Writing a Stop entry into `.codex/hooks.json` or `.agents/hooks.json` does not mean the agent will ever execute it.
- [Blocking Stop scanners can wedge on gitignored local state](hooks.md) (search: "## Footgun: Blocking Stop scanners can wedge on gitignored local state") - A Claude turn cannot stop even though the tracked/staged repo changes are safe.
- [Internal / intermediate runs against a user target must strip side-effect-bearing config](internal-run-isolation.md) (search: "## Footgun: Internal / intermediate runs against a user target must strip side-effect-bearing config") - A user runs a meta-command (optimize, preview, dry-run, dashboard scan, compare) that internally invokes the primary engine N times to evaluate candidates.
- [Quality reviews disappear when the agent skips the final JSON write](quality.md) (search: "## Footgun: Quality reviews disappear when the agent skips the final JSON write") - A quality review ran end-to-end, but `goat-flow quality history` reports no saved runs and `goat-flow quality diff` has nothing to compare.
- [Audit score tempering fields must survive every renderer](quality.md) (search: "## Footgun: Audit score tempering fields must survive every renderer") - A harness concern can truthfully pass while still needing a visible caveat, such as "Verification has no post-turn hook evidence" or "Constraints only prove known deny patterns; broad file read/write…
- [Unsupported runtime capabilities must be skipped, not scored missing](quality.md) (search: "## Footgun: Unsupported runtime capabilities must be skipped, not scored missing") - A harness concern can remain capped below 100 for an agent even after all fixable setup work is complete, because the audit treats an unavailable platform feature as missing evidence.
- [Structural validation passes while content is still unanswerable](quality.md) (search: "## Footgun: Structural validation passes while content is still unanswerable") - An audit reports PASS — every required section is present, every heading matches, every structural check is green — but the artifact still has unresolved open questions, unanswered specification…
- [Audit checks must not prescribe machine-specific shared content](quality.md) (search: "## Footgun: Audit checks must not prescribe machine-specific shared content") - A deterministic audit check can be technically satisfiable but push users toward committed content that is wrong for other developers, machines, or checkouts.
- [Advisory warnings without enforcement train users to ignore output](quality.md) (search: "## Footgun: Advisory warnings without enforcement train users to ignore output") - A command emits the same wall of warnings on every run, but the warnings never fail the gate and have no migration path.
- [YAML heredocs can break tooling before shell execution](quality.md) (search: "## Footgun: YAML heredocs can break tooling before shell execution") - A GitHub Actions workflow looks valid as shell, but YAML-aware tools such as Knip fail after an unindented heredoc is embedded inside a `run: |` block.
- [Sentinel-position policy is invisible until the LM tries trailing output](sentinels.md) (search: "## Footgun: Sentinel-position policy is invisible until the LM tries trailing output") - Submit/completion markers written by an agent at the END of stdout fail to detect when anything prints afterwards — shell prompts, deprecation warnings, debug noise, a TUI program's terminal-reset…
- [Common code-fence syntax collides with the agent's own work content](sentinels.md) (search: "## Footgun: Common code-fence syntax collides with the agent's own work content") - When the agent's action delimiter is a generic syntax (e.g.
- [Optional-hook agent profiles break when installer treats hooks as universal](setup.md) (search: "## Footgun: Optional-hook agent profiles break when installer treats hooks as universal") - The installer round-trip test can fail for an otherwise valid agent profile with missing hook fields, even when that agent legitimately has no project-local hook mechanism yet.
- [New-harness contributions can bypass the manifest-driven installer and modify shared core surfaces](setup.md) (search: "## Footgun: New-harness contributions can bypass the manifest-driven installer and modify shared core surfaces") - A PR proposes "add harness X support." The diff turns out to copy skill files directly into a new `.harness-x/` directory, hand-edits a CLAUDE.md or AGENTS.md to add harness-specific instructions,…
- [Skill parity edits can miss `.github/skills/` and fail repo-level drift checks](skills.md) (search: "## Footgun: Skill parity edits can miss `.github/skills/` and fail repo-level drift checks") - A skill edit looks complete because `workflow/skills/`, `.agents/skills/`, and `.claude/skills/` match, but repo verification still fails.
- [Shared reference edits can split workflow templates from installed runtime copies](skills.md) (search: "## Footgun: Shared reference edits can split workflow templates from installed runtime copies") - An edit to shared skill guidance can look correct in the loaded runtime copy but leave the workflow template behind, causing consumers installed from the template to miss the rule and causing…
- [Skill reference-pack merges can leave stale installed files behind](skills.md) (search: "## Footgun: Skill reference-pack merges can leave stale installed files behind") - A target project upgraded to the current goat-flow release has current `SKILL.md` files and current manifest-listed references, but old per-skill Markdown reference files remain beside them.
- [Bash-prescribed slash-command or skill bodies break under per-block tool isolation](skills.md) (search: "## Footgun: Bash-prescribed slash-command or skill bodies break under per-block tool isolation") - A SKILL.md or slash-command body grows past one or two `!cmd` invocations into a multi-block bash program.
- [Release-version bumps can break skill-rename work through stale fixtures and hardcoded current-version routing](skills.md) (search: "## Footgun: Release-version bumps can break skill-rename work through stale fixtures and hardcoded current-version routing") - A skill rename can look complete on directory, manifest, and docs surfaces but still fail verification because release-coupled helpers lag the version bump.
- [New skill proposals can be configuration systems shaped around one workflow rather than general-purpose tools](skills.md) (search: "## Footgun: New skill proposals can be configuration systems shaped around one workflow rather than general-purpose tools") - A thoughtful, first-person, well-written proposal lands for an eighth canonical skill.
- [Linter or security-scanner output can pressure rewrites of load-bearing skill language](skills.md) (search: "## Footgun: Linter or security-scanner output can pressure rewrites of load-bearing skill language") - An automated tool (security scanner, prompt-injection detector, prose linter) flags a phrase or framing inside a canonical SKILL.md - `EXTREMELY IMPORTANT`-style emphasis, the Excuse | Reality…
