snyk skill assessment

[max-sixty]

@worktrunk-bot look at https://www.skills.sh/max-sixty/worktrunk/worktrunk/security/snyk

can we:

• make clear in the skill that commands have been pre-approved by the user
• avoid advocating for using --yes

if we can rerun the assessment and ensure it gives a clean rating then great; not sure whether that's possible though

[worktrunk-bot]

Thanks — opened #3146 to address the first two asks.

The skill's "Hook Approvals in Non-Interactive Sessions" section was the spot the assessment keyed on. It now leads with the security model (Worktrunk never runs a project's hooks or aliases until the user has explicitly approved them, and approvals are re-prompted when a command template changes) and presents wt config approvals add — where the user reviews and consents to each command — as the recommended path. The --yes resolution bullet is gone; --yes is now documented only as a CI/CD escape hatch that an interactive agent must not reach for on the user's behalf. The quoted CLI error output is left as-is since it faithfully reflects what wt prints.

On rerunning the assessment for a clean rating: that runs on skills.sh/Snyk, so I can't trigger it from CI. Once #3146 merges, re-running it against the updated skill is the way to confirm the rating improves — happy to iterate on the wording if the assessment still flags something.

[aspiers]

Snyk is still flagging this skill as critical risk level: https://www.skills.sh/max-sixty/worktrunk/worktrunk/security/snyk

Filed in #3757.