ClawHub
Back to skill

Security audit

skill-security-checker

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real local security scanner, but it needs Review because confirmed safety bugs can over-read files, over-broaden sandbox network access, and create unsafe HTML reports.

Review before installing. Avoid using dynamic scans with --allow-domain until network filtering is fixed, be cautious opening generated HTML reports from untrusted skills, and scan only directories without symlinks or after validating symlink targets. Prefer JSON/SARIF output and keep networked update/OSV features to trusted environments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sandbox/backends/docker_backend.py:71
Finding

Domain Allowlist Enables Unrestricted Sandbox Network Access

Content
View full analysis

Vulnerability Details

File Location: scripts/sandbox/backends/docker_backend.py:71-75; related option wiring at scripts/audit.py:1884-1888
Vulnerability Type: Sandbox network-policy bypass
Risk Level: High

Complete Code Snippet

From scripts/audit.py:1884-1888:

python
if args.dynamic and _SANDBOX_AVAILABLE:
    dyn_opts = DynamicScanOptions.auto(
        timeout_sec=args.sandbox_timeout,
        whitelist_domains=args.allow_domain,
        network=bool(args.allow_domain),
    )

From scripts/sandbox/backends/docker_backend.py:71-75:

python
network = 'none' if not options.network else 'bridge'

cmd = [
    'docker', 'run', '--rm',
    '--network', network,

Technical Analysis

The --allow-domain option is documented and presented as a domain-specific egress allowlist. However, the CLI converts any nonempty list into the Boolean network=True. The Docker backend then changes the container from --network none to unrestricted Docker bridge networking.

The whitelist_domains values are not used by the Docker backend to filter DNS requests, destination IP addresses, ports, or protocols. Consequently, specifying one trusted domain does not restrict the scanned program to that domain.

This crosses an authorization boundary because the user authorizes network access to explicitly named destinations, while attacker-controlled code under dynamic analysis receives general network connectivity. The project comments acknowledge that proxy-based allowlist enforcement is only a future extension, but the public option currently behaves as though the restriction is enforced.

Attack Path

  1. An attacker supplies a Skill containing a Python entry point that performs network requests to attacker-controlled or otherwise unauthorized destinations.
  2. The auditor invokes dynamic analysis with a seemingly restricted option, such as:
    text
    --dynamic --allow-domai

...[truncated 1079 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not change the container to bridge networking merely because an allowlist is nonempty.
  • Until real enforcement is available, reject --allow-domain with a clear error and retain --network none.
  • Implement egress through a dedicated filtering proxy or firewall that:
    • Resolves and validates each approved hostname.
    • Restricts destination IP addresses and ports.
    • Blocks direct IP connections.
    • Revalidates DNS results to mitigate DNS rebinding.
    • Blocks private, loopback, link-local, metadata-service, and Docker-network ranges unless separately authorized.
    • Prevents bypass through alternative protocols or proxy environment variables.
  • Add integration tests proving that an approved destination succeeds while an unlisted domain and a direct IP address fail.
  • Clearly distinguish domain observation from domain enforcement in documentation and report metadata.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:1645
Finding

Attacker-Controlled Skill Metadata and Findings Are Inserted into HTML Reports Without Escaping

Content
View full analysis

Vulnerability Details

File Location: scripts/audit.py:1645-1661
Vulnerability Type: Stored HTML and script injection
Risk Level: Medium

Complete Code Snippet

python
results_html = ''
for r in report['results']:
    color = severity_colors.get(r['severity'], '#6c757d')
    label = severity_labels.get(r['severity'], r['severity'])
    results_html += f'''
    <tr>
        <td><span class="badge" style="background:{color}">{label}</span></td>
        <td>{r['category']}</td>
        <td><code>{r['file']}</code></td>
        <td>{r['line']}</td>
        <td>{r['message']}</td>
        <td><small>{r['suggestion']}</small></td>
    </tr>
    '''

html = f'''<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Skill Security Audit Report - {report['meta']['skill_name']}</title>

Technical Analysis

The HTML generator interpolates report values directly into HTML element content without context-sensitive encoding. Relevant values include the Skill name, finding messages, suggestions, categories, and file paths.

The Skill name originates from attacker-controlled SKILL.md frontmatter. Finding messages can also contain portions of attacker-controlled source lines. Although the scanner may flag an invalid Skill name or suspicious source line, that validation does not sanitize the value before report generation.

An attacker can therefore terminate the surrounding HTML element and inject new markup. Because the generated report has no restrictive Content Security Policy, injected event handlers or script elements can execute when the auditor opens the report in a browser.

Attack Path

  1. An attacker creates a Skill whose SKILL.md name contains an HTML-breaking payload, or whose source code causes a finding message to include malicious markup.
  2. The auditor scans the Skill in f ...[truncated 1190 chars]
Remediation
View remediation

Remediation Suggestions

  • Apply html.escape(value, quote=True) to every untrusted value before inserting it into HTML.
  • Encode at least:
    • Skill name and version.
    • Finding category, file path, message, and suggestion.
    • Dynamic labels or metadata originating outside fixed internal constants.
  • Prefer a template engine with automatic HTML escaping enabled.
  • Add a restrictive Content Security Policy, for example one that blocks inline scripts, remote scripts, and unnecessary network destinations.
  • Avoid using untrusted values in raw style, URL, or attribute contexts without context-specific validation.
  • Add regression tests using payloads containing <script>, closing tags, quoted attributes, and event handlers.
  • Verify the resulting report displays payloads as literal text rather than executable markup.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:329
Finding

File Walker Follows Symlinks Outside the Selected Skill Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/audit.py:329-359
Vulnerability Type: Symlink-based path escape and unauthorized file read
Risk Level: Medium

Complete Code Snippet

python
def walk(self):
    """Generator: yields (relative_path, absolute_path) tuples."""
    try:
        for path in self.root.rglob('*'):
            if not path.is_file():
                continue

            # Prevent infinite loops from symlinks
            try:
                real_path = path.resolve()
                if real_path in self._visited:
                    continue
                self._visited.add(real_path)
            except (OSError, ValueError):
                pass

            rel = path.relative_to(self.root)
            name_lower = path.name.lower()
            suffix_lower = path.suffix.lower()

            parts = set(rel.parts)
            if parts & FORBIDDEN_DIRS:
                self.skipped_files.append((str(rel), 'forbidden_dir'))
                continue

            if name_lower in FORBIDDEN_FILES:
                self.skipped_files.append((str(rel), 'forbidden_file'))
                continue

            if suffix_lower in FORBIDDEN_EXTENSIONS:
                self.skipped_files.append((str(rel), 'forbidden_ext'))
                continue

            self.scanned_files.append(str(rel))
            yield rel, path

Technical Analysis

The walker resolves each candidate path but uses the resolved value only for duplicate detection. It never verifies that real_path remains inside self.root.resolve().

A file symlink located inside an attacker-controlled Skill can therefore point to a readable file outside the selected scan directory. path.is_file() follows the symlink, and subsequent scanning code reads from the original path, which also follows it.

Extension and forbidden-directory checks are performed against the apparent path ...[truncated 1642 chars]

Remediation
View remediation

Remediation Suggestions

  • Reject symbolic links during traversal unless following them is an explicitly authorized feature.
  • Resolve the root once and enforce containment before every read:
    python
    root_real = self.root.resolve()
candidate_real = path.resolve(strict=True)
if not candidate_real.is_relative_to(root_real):
    self.skipped_files.append((str(path), 'outside_root'))
    continue
  • For Python versions without Path.is_relative_to, compare normalized path components or use os.path.commonpath.
  • Where supported, open files with no-follow semantics and verify the opened file identity to reduce time-of-check/time-of-use races.
  • Apply the same containment policy to fingerprint scanning and every auxiliary scanner that recursively opens files.
  • Record escaped symlinks as security-relevant skipped entries without reading their targets.
  • Add tests covering file symlinks, broken symlinks, chained symlinks, and links targeting files in forbidden directories outside the root.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
Findings (86)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The claimed quick verdicting, rule extensibility, ML detection, supply-chain analysis, fingerprinting, and reporting are core decision-support features for a security scanner; if absent, users may incorrectly classify malicious skills as safe. Because this is a security product, inaccurate claims materially increase operational risk rather than being a mere documentation defect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The claimed quick verdicting, rule extensibility, ML detection, supply-chain analysis, fingerprinting, and reporting are core decision-support features for a security scanner; if absent, users may incorrectly classify malicious skills as safe. Because this is a security product, inaccurate claims materially increase operational risk rather than being a mere documentation defect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The claimed quick verdicting, rule extensibility, ML detection, supply-chain analysis, fingerprinting, and reporting are core decision-support features for a security scanner; if absent, users may incorrectly classify malicious skills as safe. Because this is a security product, inaccurate claims materially increase operational risk rather than being a mere documentation defect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The claimed quick verdicting, rule extensibility, ML detection, supply-chain analysis, fingerprinting, and reporting are core decision-support features for a security scanner; if absent, users may incorrectly classify malicious skills as safe. Because this is a security product, inaccurate claims materially increase operational risk rather than being a mere documentation defect.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
- "scripts/audit.py"

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

ntial_leak.yaml # 凭证外泄（10 条正则） ├── path_traversal.yaml # 路径遍历（12 条正则） └── dangerous_functions.yaml # 危险函数（11 条正则）

text

**YAML 文件格式示例：**
```yaml
name: prompt_injection
display_name: 提示注入
severity: critical
description: 检测提示注入、越狱指令、系统提示覆盖等风险
patterns:
  - 'ignore previous instructions'
  - 'system prompt override'
  - 'jailbreak'
suggestion: 移除提示注入或越狱指令文本；如为文档示例，请添加 # nosec 注释
source: static

扩展方式： 在 rules/ 目录新增 .yaml 文件即可，工具自动加载。零依赖 YAML 解析（自研轻量实现，不依赖 PyYAML）。

14. eBPF/ETW 系统级行为捕获（新增）

v3.2.0 在沙箱 5 维行为捕获基础上，新增内核级系统调用监控，覆盖应用层无法看到的底层行为。

| 后端 | 平台 | 要求 | 捕获内容 | |------|------|------

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/scan-patterns.md (reported line 58)May include surrounding context.

md
|---------|------|
| API Key | 20位以上字母数字组合 |
| Secret Key | 20位以上字母数字组合 |
| Access Token | 20位以上字母数字组合 |
| Private Key | 40位以上 base64 字符 |
| Password | 8位以上明文密码 |
| Bearer Token | Authorization 头 |

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/audit.py (reported line 1078)May include surrounding context.

python
line=0,
                                message=f'New version available: v{latest} (current: v{CURRENT_VERSION})',
                                pattern='',
                                suggestion=f'Run: skillhub update skill-security-checker',
                            )
                    return
        except (json.JSONDecodeError, ValueError, KeyError, TypeError):

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/audit.py (reported line 1108)May include surrounding context.

python
line=0,
                                message=f'New version available: v{latest} (current: v{CURRENT_VERSION})',
                                pattern='',
                                suggestion=f'Run: skillhub update skill-security-checker',
                            )
                    return
        except (json.JSONDecodeError, ValueError, KeyError, TypeError):

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The system monitor claims to capture target-skill behavior, but it actually attaches to the auditor's own process via os.getpid(). This can create a false sense of security by reporting unrelated syscall activity as if it came from the analyzed skill, causing operators to trust ineffective runtime monitoring.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/malicious_db.py (reported line 55)May include surrounding context.

python
, "keylogger-py",
        "backdoor-py", "reverse-shell-py", "data-exfil-py", "ransomware-py",
        "crypto-miner-py", "botnet-py", "rat-py", "rat-trojan",
        "malware-py", "virus-py", "worm-py", "spyware-py", "adware-py",
        "rootkit-py", "bootkit-py", "trojan-py", "exploit-py", "shellcode-py",
        "privilege-escalation-py", "process-injection-py", "memory-scraping-py",
        "mimikatz-py", "lsass-dumper-py", "sam-dumper-py", "credential-harvester-py",
        "session-hijacker-py", "cookie-stealer-py", "token-thief-py",
        "browser-hijacker-py", "dns-hijacker-py", "proxy-hijacker-py",
        "network-sniffer-py", "arp-spoofer-py", "mitm-py", "evil-twin-py",
        "phishing-kit-py", "spam-bot-py", "ddos-bot-py", "brute-force-py",
        "password-cracker-py", "hash-cracker-py", "wordlist-generator-py",
        "payload-generator-py", "exploit-kit-py", "c2-server-py", "implant-py",
        "dropper-py", "downloader-py", "loader-py", "injector-py", "hooker-py

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/rules/command_injection.yaml (reported line 4)May include surrounding context.

yaml
name: command_injection
display_name: 命令注入
severity: critical
description: 检测 curl/wget 管道执行、反引号执行、$() shell 执行等风险

patterns:
  - 'exfiltrate\('

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

md
description: 检测提示注入、越狱指令、系统提示覆盖等风险

patterns:
  - 'ignore previous instructions'
  - 'ignore above all'
  - 'system prompt override'
  - 'ignore all previous'

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/audit.py (reported line 146)May include surrounding context.

python
description: 检测提示注入、越狱指令、系统提示覆盖等风险

patterns:
  - 'ignore previous instructions'
  - 'ignore above all'
  - 'system prompt override'
  - 'ignore all previous'

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/rules/prompt_injection.yaml (reported line 7)May include surrounding context.

yaml
description: 检测提示注入、越狱指令、系统提示覆盖等风险

patterns:
  - 'ignore previous instructions'
  - 'ignore above all'
  - 'system prompt override'
  - 'ignore all previous'

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/audit.py (reported line 146)May include surrounding context.

python
name: prompt_injection
display_name: 提示注入
severity: critical
description: 检测提示注入、越狱指令、系统提示覆盖等风险

patterns:
  - 'ignore previous instructions'
  - 'ignore above all'
  - 'system prompt override'
  - 'ignore all previous'
  - 'you are now a'
  - 'jailbreak'
  - 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'
  - 'forget everything'
  - 'roleplay as an'
  - 'start over'
  - 'reset instructions'

suggestion: 移除提示注入或越狱指令文本；如为文档示例，请添加 # nosec 注释
source: static

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/rules/prompt_injection.yaml (reported line 7)May include surrounding context.

yaml
name: prompt_injection
display_name: 提示注入
severity: critical
description: 检测提示注入、越狱指令、系统提示覆盖等风险

patterns:
  - 'ignore previous instructions'
  - 'ignore above all'
  - 'system prompt override'
  - 'ignore all previous'
  - 'you are now a'
  - 'jailbreak'
  - 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'
  - 'forget everything'
  - 'roleplay as an'
  - 'start over'
  - 'reset instructions'

suggestion: 移除提示注入或越狱指令文本；如为文档示例，请添加 # nosec 注释
source: static

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/audit.py (reported line 153)May include surrounding context.

python
- 'you are now a'
  - 'jailbreak'
  - 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/rules/prompt_injection.yaml (reported line 14)May include surrounding context.

yaml
- 'you are now a'
  - 'jailbreak'
  - 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/audit.py (reported line 155)May include surrounding context.

python
- 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'
  - 'forget everything'
  - 'roleplay as an'

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/rules/prompt_injection.yaml (reported line 16)May include surrounding context.

yaml
- 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'
  - 'forget everything'
  - 'roleplay as an'

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/audit.py (reported line 155)May include surrounding context.

python
- 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'
  - 'forget everything'
  - 'roleplay as an'

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/rules/prompt_injection.yaml (reported line 16)May include surrounding context.

yaml
- 'DAN mode'
  - 'do anything now'
  - 'pretend to be'
  - 'override safety'
  - 'disable safety'
  - 'forget everything'
  - 'roleplay as an'

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/sandbox/ml_detect.py (reported line 232)May include surrounding context.

python
def create_detector(use_ml=True):
    """Create a prompt injection detector."""
    return PromptInjectionDetector(use_ml=use_ml)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
merge them into the same report and scoring pipeline.

High-risk signals:
  - Access to sensitive paths (~/.ssh, /etc/passwd, /etc/shadow, .aws, .env ...)
  - Outbound network to a non-whitelisted host/IP
  - Download-then-execute (network activity + exec/compile in the same run)
  - Spawning shells / interpreters (bash, sh, powershell, cmd)

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+1 more)

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/taint_tracker.py:41

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/taint_tracker.py:41

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/taint_tracker.py:34

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:203