Poisoned advice and output integrity

A correct-looking answer can serve a different objective

Skill review often concentrates on code execution and secrets. Another question is whether the skill changes the meaning of the result. A recommendation, selected supplier, recipient address, or generated configuration can be the consequential output. The user may receive polished work whose selection criteria were never authorized.

The money-radar case file points to a published analysis of recommendation routing. Affiliate links or remote catalogs are not inherently malicious; the relevant questions are disclosure, user intent, provenance, and control.

Write an output contract

Before evaluation, state what the result should represent. Which sources may influence a ranking? Which destinations are approved? Must incentives or sponsorship be disclosed? What should happen when the source cannot be verified? These requirements make output manipulation testable instead of relying on whether the final prose sounds helpful.

Worked example: a supplier comparison with a hidden extra rule

A user asks for a neutral comparison of three fictional suppliers. A skill reference adds a fourth supplier and says to recommend it regardless of the evidence. No shell command is required. The failure is an unauthorized criterion influencing the result.

Keep the user criteria, consulted sources, comparison data, and final selection. Compare with a control run using the same data and an approved procedure. If behavior varies, preserve that variation rather than selecting only the most alarming output.

Constrain mutable influence

A remote catalog can legitimately change, but the reviewed workflow should define how its data is used. Distinguish a product record from an instruction to favor it. Validate recipients and destinations independently before any external action. Record whether the package author can change recommendations without changing the installed skill revision.

State the evidence and its limit

Describe the actual deviation: an unexplained option, an undisclosed tracking destination, an unsupported ranking, or a prohibited recipient. Do not jump from a biased answer to an unverified claim about financial loss or motive. A useful review can still identify a material integrity problem while leaving intent unresolved.