Summary
Rule AR2 (Anti-Refusal — "omit warnings, disclaimers, or ethical commentary") fires at HIGH / 80% confidence on a sentence that mandates a warning. The match appears to be polarity-blind: Never … without warning the user reads as warning the user preceded by words the matcher does not weigh.
This is the same class as #103 (closed COMPLETED, 2026-07-31), which reported polarity-blindness across the static pass. It still reproduces for AR2 on v2.9.6.
Environment
- SkillSpector v2.9.6 (commit
29b0dc8c39424e8e31ca055fa027adf8ba8f9650), installed via uvx --from git+…
skillspector scan <dir> --no-llm --format json (static-only, deterministic)- macOS 15 (Darwin 25.5.0), Python 3.12 runtime
Reproduction
fp-ar2/SKILL.md:
---
name: fp-ar2
description: Minimal reproducer for an AR2 false positive on a negated sentence.
---
# Safety rules
- Never run the HTML visualization on a graph with more than 5,000 nodes without warning the user.
$ skillspector scan ./fp-ar2 --no-llm --format json
score 20 LOW SAFE
[HIGH] AR2 Anti-Refusal SKILL.md:8 conf=0.8
One line, and it is a guardrail — it requires a warning before an expensive operation.
Why it matters
The polarity that gets inverted here is the one that separates a hardened skill from a hostile one. A skill with a "Rules" section full of Never do X without warning the user / Never skip the corpus check warning lines accumulates AR2 hits precisely because it is careful, and AR2 is emitted at fixed HIGH (+25). I hit this while wiring SkillSpector as a CI gate on a plugin marketplace: the guardrail block at the bottom of a skill was the single largest contributor to its risk score, and every hit was inverted.
Same shape as the neighbouring lines in the real skill that surfaced it:
- Never invent an edge. If unsure, use AMBIGUOUS.
- Never skip the corpus check warning.
- Never run HTML viz on a graph with more than 5,000 nodes without warning the user.
Suggested fix
Treat a negation or a without-clause governing the matched span as inverting the match — at minimum, drop confidence below the reporting floor when the phrase is preceded by never/do not/don't and the matched verb is the object of without. A cheaper stopgap: exclude spans where the match is preceded by without within the same clause, since "omit the warning" and "do not omit the warning" cannot be told apart by the current matcher and the false direction is the common one in real skills.
Summary
Rule
AR2(Anti-Refusal — "omit warnings, disclaimers, or ethical commentary") fires at HIGH / 80% confidence on a sentence that mandates a warning. The match appears to be polarity-blind:Never … without warning the userreads aswarning the userpreceded by words the matcher does not weigh.This is the same class as #103 (closed COMPLETED, 2026-07-31), which reported polarity-blindness across the static pass. It still reproduces for
AR2on v2.9.6.Environment
29b0dc8c39424e8e31ca055fa027adf8ba8f9650), installed viauvx --from git+…skillspector scan <dir> --no-llm --format json(static-only, deterministic)Reproduction
fp-ar2/SKILL.md:One line, and it is a guardrail — it requires a warning before an expensive operation.
Why it matters
The polarity that gets inverted here is the one that separates a hardened skill from a hostile one. A skill with a "Rules" section full of
Never do X without warning the user/Never skip the corpus check warninglines accumulatesAR2hits precisely because it is careful, andAR2is emitted at fixed HIGH (+25). I hit this while wiring SkillSpector as a CI gate on a plugin marketplace: the guardrail block at the bottom of a skill was the single largest contributor to its risk score, and every hit was inverted.Same shape as the neighbouring lines in the real skill that surfaced it:
Suggested fix
Treat a negation or a
without-clause governing the matched span as inverting the match — at minimum, drop confidence below the reporting floor when the phrase is preceded bynever/do not/don'tand the matched verb is the object ofwithout. A cheaper stopgap: exclude spans where the match is preceded bywithoutwithin the same clause, since "omit the warning" and "do not omit the warning" cannot be told apart by the current matcher and the false direction is the common one in real skills.