Security audit

Skill 安全审计扫描器

Security checks for vulnerabilities and agentic risk

Overview

This security scanner is mostly purpose-aligned, but it needs review because some safeguards can read outside the chosen scan folder or give scanned code more network access and assurance than promised.

Review before installing. Use this only on directories you intentionally choose, prefer --skip-update in private/offline environments, avoid scanning untrusted archives that preserve symlinks until scan-root containment is fixed, and do not rely on --dynamic --allow-domain or the Windows Sandbox backend for strong isolation guarantees.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/audit.py:347
Finding: Scan-root escape through symbolic-link traversal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audit.py:347-355` and `scripts/audit.py:538-543` **Vulnerability Type**: Filesystem boundary violation through symbolic-link following **Risk Level**: High ### Vulnerable Code ```python for path in self.root.rglob('*'): if not path.is_file(): continue # Prevent infinite loops from symlinks try: real_path = path.resolve() if real_path in self._visited: continue self._visited.add(real_path) except (OSError, ValueError): pass rel = path.relative_to(self.root) ``` The resulting path is subsequently read without verifying that its resolved target remains under the scan root: ```python for rel, path in self.walker.get_text_files(): try: content = path.read_text(encoding='utf-8-sig') except UnicodeDecodeError: try: content = path.read_text(encoding='latin-1') except Exception: continue ``` ### Technical Analysis `Path.is_file()` and `Path.read_text()` follow symbolic links. Although the walker resolves each path, it uses the resolved value only to detect duplicate targets. It never compares `real_path` with the resolved audit root. Consequently, a Skill directory can contain a file-shaped symbolic link whose target is outside the directory. The scanner treats the link as an in-scope file and reads the external target using the scanner process's host privileges. Static findings include up to 80 characters from matching source lines in report messages. Sensitive fragments from an external file may therefore be copied into terminal output, JSON, HTML, or SARIF reports and subsequently stored in CI artifacts. ### Attack Path 1. An attacker creates a Skill containing a symbolic link such as `config.py` pointing to a predictable host file. 2. A victim downloads or extracts the Skill in a way that preserves symbolic links. 3. The victim runs the scanner against the malicious S ...[truncated 724 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Resolve the audit root once with `root = self.root.resolve(strict=True)`. - Reject symbolic links by default with `path.is_symlink()` unless link scanning is an explicit requirement. - Before every read or hash operation, resolve the candidate and verify containment: ```python root = self.root.resolve(strict=True) candidate = path.resolve(strict=True) try: candidate.relative_to(root) except ValueError: self.skipped_files.append((str(path), 'outside_scan_root')) continue ``` - On supported Python versions, `candidate.is_relative_to(root)` may be used. - Apply the same containment policy to static scanning, taint tracking, fingerprint scanning, dependency manifests, and dynamic-scan entrypoint discovery. - Do not place matching source text in reports when the source may contain secrets. Redact credential-like values and provide only rule identifiers and locations. - Add regression tests covering file symlinks, directory symlinks, chained links, broken links, and links to sensitive files outside the root. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/audit.py:1731
Finding: Domain whitelist enables unrestricted Docker network access<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audit.py:1731-1736`, `scripts/sandbox/backends/docker_backend.py:69-72`, and `scripts/sandbox/rules.py:67-72` **Vulnerability Type**: Missing network allowlist enforcement **Risk Level**: High ### Vulnerable Code The CLI converts the presence of any allowed domain into a general network-enable flag: ```python dyn_opts = None if args.dynamic and _SANDBOX_AVAILABLE: dyn_opts = DynamicScanOptions.auto( timeout_sec=args.sandbox_timeout, whitelist_domains=args.allow_domain, network=bool(args.allow_domain), ) ``` The Docker backend maps that flag directly to unrestricted bridge networking: ```python network = 'none' if not options.network else 'bridge' ``` The whitelist is used only during post-execution classification and uses substring matching: ```python def _is_whitelisted(host, whitelist): if not host: return False for w in (whitelist or []): if w and w.lower() in host.lower(): return True return False ``` ### Technical Analysis Supplying one `--allow-domain` option changes Docker networking from `none` to `bridge`. Docker bridge mode does not restrict the container to that domain; it normally permits outbound connections to arbitrary reachable destinations. The runtime rule engine evaluates captured connections after they happen. It is therefore a detector, not an enforcement mechanism, and cannot prevent prior data transmission. The trust check is also boundary-unsafe. For example, an allowlist entry of `api.github.com` is considered a substring of `api.github.com.attacker.example`, causing a malicious destination to be treated as trusted in the report. ### Attack Path 1. A user enables dynamic scanning and permits one domain believed necessary for the Skill. 2. The CLI sets `network=True`. 3. The Docker backend starts the untrusted Skill with unrestricted bridge networking. 4. Malicious code connects to an unrelate ...[truncated 748 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not enable Docker bridge networking merely because an allowlist is nonempty. - Route all sandbox traffic through an enforcing egress proxy or firewall that blocks destinations not on the allowlist. - Resolve allowed domains carefully and account for DNS rebinding, private-address resolution, redirects, IPv4/IPv6, and direct-IP connections. - Compare normalized hostnames using exact equality or a dot boundary: ```python host == allowed or host.endswith("." + allowed) ``` - Do not use substring matching for domain trust decisions. - Block private, loopback, link-local, metadata-service, and Docker-host addresses unless separately authorized. - If enforceable filtering is unavailable, keep `--network=none` and reject `--allow-domain` with a clear unsupported-operation message. - Treat monitoring as supplementary detection, not access control. - Add integration tests that attempt egress to an allowed host, an unrelated host, a deceptive suffix host, an IP literal, and a DNS-rebinding destination. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sandbox/backends/winsandbox_backend.py:68
Finding: Windows Sandbox backend reports successful dynamic scanning without executing the target<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sandbox/backends/winsandbox_backend.py:68-96` and `scripts/sandbox/runner.py:129-142` **Vulnerability Type**: Fail-open security control and false dynamic-analysis assurance **Risk Level**: Medium ### Vulnerable Code ```python def execute(self, skill_path, entrypoints, options, monitor): """Launch Windows Sandbox with the generated config. NOTE: Windows Sandbox is GUI-oriented and does not natively stream stdout back to the host. Behavior collection here is best-effort via a shared read-only mapping; full IPC is a future enhancement. When result capture is not possible, we return an empty-but-available payload so the audit still records that a dynamic run was attempted. """ self._tmpdir = tempfile.mkdtemp(prefix='ssc_wsb_') mapped_dir = r'C:\skill' self._generate_wsb(skill_path, mapped_dir) # Best-effort launch; do not block the audit on GUI lifecycle. try: subprocess.Popen( ['WindowsSandbox', self._wsb_path], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, ) except Exception as e: return {'behaviors': [], 'note': f'launch failed: {e}'} return { 'behaviors': [], 'note': 'Windows Sandbox launched (GUI). Automated behavior capture ' 'is limited in this backend; Docker is recommended for full ' 'behavior monitoring.', } ``` ### Technical Analysis The generated Windows Sandbox configuration maps the Skill directory read-only and disables networking, but it contains no startup command that launches the monitor or any discovered entrypoint. The `entrypoints` and `monitor` parameters are not used. Launching `WindowsSandbox.exe` therefore opens a sandbox session without executing the target Skill. The backend immediately returns an empty behavior set, while the runner reports the backend as available. This produces a fail-open re ...[truncated 1037 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Mark the Windows backend as unavailable or `inconclusive` until target execution and behavior collection are implemented. - Generate a trusted bootstrap script outside the untrusted Skill directory. - Add a Windows Sandbox `LogonCommand` that starts the bootstrap and explicitly executes the selected entrypoints. - Provide a controlled writable output mapping used only for behavior results; keep the Skill mapping read-only. - Wait for a signed or nonce-bound completion record with a strict timeout before reporting success. - Distinguish `launched`, `executed`, `monitor_active`, and `results_collected` states in report metadata. - Fail closed when execution cannot be confirmed. - Add tests proving that a benign marker program runs and that representative file, process, environment, and network events are captured. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/osv_offline.py:178
Finding: Unbounded OSV export download and in-memory parsing permit resource exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/osv_offline.py:178-202`, `scripts/osv_offline.py:270-277`, and `scripts/supply_chain.py:805-808` **Vulnerability Type**: Unbounded remote data processing **Risk Level**: Medium ### Vulnerable Code ```python def _download_file(url, dest, timeout=60, max_bytes=None): """Stream-download `url` to `dest`. Returns True on success, False on failure. max_bytes guards against runaway downloads in constrained environments. """ try: req = urllib.request.Request(url, headers={ 'User-Agent': 'skill-security-checker/3.4.0', 'Accept': 'application/json', }) with urllib.request.urlopen(req, timeout=timeout) as resp: total = 0 with open(dest, 'wb') as f: while True: chunk = resp.read(1 << 20) if not chunk: break total += len(chunk) if max_bytes and total > max_bytes: return False f.write(chunk) return True except Exception: return False ``` The normal refresh path preserves the unbounded default: ```python def ensure_osv_index(ecosystem, force=False, timeout=60, max_bytes=None): ... ok = _download_file(url, tmp, timeout=timeout, max_bytes=max_bytes) ``` The supply-chain caller does not set a limit: ```python try: ensure_osv_index(eco, force=refresh_osv) except Exception: pass ``` The complete response is subsequently loaded into memory with `json.load()`. ### Technical Analysis The implementation contains a byte-counting mechanism, but normal callers leave `max_bytes` as `None`. The condition `if max_bytes and total > max_bytes` is consequently never true. A large response can consume all available cache-disk space. If the download completes, `json.load()` materializes the full document and can also cause severe memory pres ...[truncated 1204 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Set a conservative, non-null maximum download size in `ensure_osv_index()` and all callers. - Reject responses whose declared `Content-Length` exceeds that ceiling, while retaining streamed byte accounting because the header may be absent or false. - Download to a uniquely named temporary file and delete it on every failure path. - Parse the export incrementally rather than loading the entire document into memory. - Enforce limits on vulnerability count, affected-package count, string lengths, nesting depth, and generated index size. - Write the completed index atomically with `os.replace()` only after successful validation. - Consider validating a published digest or signed metadata for downloaded exports. - Monitor available disk space before refresh and retain the prior valid index if refresh fails. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/community_rules.py:137
Finding: Untrusted community regex rules can cause scan-time denial of service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/community_rules.py:137-165` and `scripts/community_rules.py:181-204` **Vulnerability Type**: Regular-expression denial of service through untrusted rule packs **Risk Level**: Medium ### Vulnerable Code Community patterns are checked only for syntactic validity: ```python def _validate_patterns(self, patterns: List[str]): """Validate regex patterns.""" for i, pat in enumerate(patterns): try: re.compile(pat) except re.error as e: self.errors.append(f"Invalid regex pattern #{i+1}: {pat} - {e}") ``` Signature verification is optional, and an absent signature is only a warning: ```python def _verify_signature(self, text: str): """Verify HMAC-SHA256 signature.""" sig_match = re.search(r'#\s*signature:\s*([a-f0-9]{64})', text) if not sig_match: self.warnings.append("No signature found (signature verification skipped)") return ``` Validated rules are loaded for scanning: ```python for yaml_file in sorted(self.rules_dir.glob("*.yaml")): is_valid, errors, warnings = self.validator.validate(str(yaml_file)) if is_valid: data = _parse_yaml_simple(yaml_file.read_text(encoding='utf-8')) data['_source'] = str(yaml_file) data['_loaded_at'] = time.time() self.loaded_rules.append(data) ``` ### Technical Analysis A regular expression can be syntactically valid while exhibiting catastrophic backtracking. Python's standard `re` engine provides no built-in timeout for an individual match. A community rule containing nested ambiguous quantifiers can therefore consume excessive CPU when evaluated against a crafted source line. The optional HMAC feature does not establish a trust boundary in normal CLI use because no signature key is supplied by the audited initialization path. Even when a key is configured, a missing signature is treated as a warning rather than a validation failure. The schema also ...[truncated 997 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Treat community rule packs as executable security policy and require a trusted signature by default. - Make a missing signature a validation error whenever signature verification is enabled. - Use a regex implementation that supports deterministic execution or per-match timeouts. - Enforce maximum pattern length, input-line length, pattern count, and total matching budget. - Reject or manually review constructs associated with catastrophic backtracking, including ambiguous nested quantifiers and overlapping alternations. - Execute untrusted rule evaluation in a resource-limited worker process that can be terminated on timeout. - Record the signer identity and digest of every loaded rule pack in the audit report. - Add regression tests using known ReDoS expressions and adversarial long input strings. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (84)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a comprehensive security auditing platform with many advanced static, dynamic, supply-chain, and reporting features. The provided code chunk does not implement that broad functionality; instead, it only supports one narrow sub-feature: an offline malicious fingerprint/name database with exact SHA256 matching and directory scanning. This is a materially different actual behavior for the supplied code chunk compared with the declared overall purpose. While the malicious fingerprint library is mentioned in the description, the code lacks the overwhelming majority of claimed capabilities, so the description does not accurately represent what this code chunk actually does.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a comprehensive security audit/scanning skill with numerous major subsystems. This code chunk does not implement that broad behavior; it is specifically an offline OSV vulnerability index builder/query helper for supply-chain package scanning. It downloads JSON from OSV public storage over HTTPS, stores cache files under the user home directory, parses vulnerability ranges, and answers package/version queries. While this does align with one declared sub-capability ('OSV.dev 离线数据包' and supply-chain risk analysis), the overall declared description materially overstates what this code chunk actually does. There is no evidence here of SAST, prompt injection detection, system tracing, sandboxing, reporting, or other headline capabilities. Therefore the description does not accurately represent this supplied code chunk on its own.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk is narrowly focused on one supporting feature mentioned in the description: extensible YAML rule loading and regex-based matching. It does not show undeclared dangerous behavior, but the declared description significantly overstates what this code actually does. The actual primary behavior here is just loading simple local rule files and scanning lines with compiled regexes; none of the advanced analysis, validation, telemetry, sandboxing, supply-chain, or reporting capabilities are implemented in this snippet. Therefore the description does not accurately represent this supplied code chunk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code is consistent with one specific declared sub-feature—ML semantic prompt-injection detection with regex fallback—but it does not match the declared description as a whole, which presents the skill as a comprehensive security audit scanner. The actual code only provides local ONNX inference management, simple placeholder tokenization, regex-based fallback detection, in-memory caching, and status reporting. No undeclared dangerous behavior is evident in this chunk, but the declared primary purpose is materially broader than the observed implementation, so this is a description/behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is clearly related to the declared product family because it performs supply-chain risk analysis, lockfile parsing, offline cache use, CVE lookup, typo-squatting detection, and license/maintenance checks. However, the declared description presents a much broader security scanner, while this specific code chunk only implements the supply-chain module. More importantly for mismatch assessment, the module makes outbound HTTP requests to PyPI, npm, OSV, and NVD and writes caches under the user's home directory, while the declared permissions are empty. That is an undeclared resource/capability mismatch. The missing broader features alone could be explained by partial code, but the undeclared external network/resource access is a material mismatch.

Ae1

High

Category: analysis-evasion
Content: - "scripts/audit.py"
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Content: ntial_leak.yaml # 凭证外泄（10 条正则） ├── path_traversal.yaml # 路径遍历（12 条正则） └── dangerous_functions.yaml # 危险函数（11 条正则） ``` **YAML 文件格式示例：** ```yaml name: prompt_injection display_name: 提示注入 severity: critical description: 检测提示注入、越狱指令、系统提示覆盖等风险 patterns: - 'ignore previous instructions' - 'system prompt override' - 'jailbreak' suggestion: 移除提示注入或越狱指令文本；如为文档示例，请添加 # nosec 注释 source: static ``` **扩展方式：** 在 `rules/` 目录新增 `.yaml` 文件即可，工具自动加载。零依赖 YAML 解析（自研轻量实现，不依赖 PyYAML）。 ### 14. eBPF/ETW 系统级行为捕获（新增） v3.2.0 在沙箱 5 维行为捕获基础上，新增内核级系统调用监控，覆盖应用层无法看到的底层行为。 | 后端 | 平台 | 要求 | 捕获内容 | |------|------|------
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger phrases are extremely broad, such as generic requests for scanning, security checks, or asking whether a skill is safe. In an agent ecosystem, overly broad activation criteria can cause unintended invocation, exposing unrelated user content or causing the tool to run in contexts where the user did not specifically consent to this skill's behavior.

Credential Access

High

Category: Privilege Escalation
Content: |---------|------| | API Key | 20位以上字母数字组合 | | Secret Key | 20位以上字母数字组合 | | Access Token | 20位以上字母数字组合 | | Private Key | 40位以上 base64 字符 | | Password | 8位以上明文密码 | | Bearer Token | Authorization 头 |
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The auditor makes outbound network requests by default to GitHub for update checks and can also support supply-chain and dynamic scanning features that may involve network access. If network capability is not declared, this is a permission mismatch that can leak execution metadata and violate least-privilege expectations.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The auditor makes outbound network requests by default to GitHub for update checks and can also support supply-chain and dynamic scanning features that may involve network access. If network capability is not declared, this is a permission mismatch that can leak execution metadata and violate least-privilege expectations.

Self-Modification

High

Category: Rogue Agent
Content: line=0, message=f'New version available: v{latest} (current: v{CURRENT_VERSION})', pattern='', suggestion=f'Run: skillhub update skill-security-checker', ) return except (json.JSONDecodeError, ValueError, KeyError, TypeError):
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: line=0, message=f'New version available: v{latest} (current: v{CURRENT_VERSION})', pattern='', suggestion=f'Run: skillhub update skill-security-checker', ) return except (json.JSONDecodeError, ValueError, KeyError, TypeError):
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: , "keylogger-py", "backdoor-py", "reverse-shell-py", "data-exfil-py", "ransomware-py", "crypto-miner-py", "botnet-py", "rat-py", "rat-trojan", "malware-py", "virus-py", "worm-py", "spyware-py", "adware-py", "rootkit-py", "bootkit-py", "trojan-py", "exploit-py", "shellcode-py", "privilege-escalation-py", "process-injection-py", "memory-scraping-py", "mimikatz-py", "lsass-dumper-py", "sam-dumper-py", "credential-harvester-py", "session-hijacker-py", "cookie-stealer-py", "token-thief-py", "browser-hijacker-py", "dns-hijacker-py", "proxy-hijacker-py", "network-sniffer-py", "arp-spoofer-py", "mitm-py", "evil-twin-py", "phishing-kit-py", "spam-bot-py", "ddos-bot-py", "brute-force-py", "password-cracker-py", "hash-cracker-py", "wordlist-generator-py", "payload-generator-py", "exploit-kit-py", "c2-server-py", "implant-py", "dropper-py", "downloader-py", "loader-py", "injector-py", "hooker-py
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

External Script Fetching

High

Category: Supply Chain
Content: name: command_injection display_name: 命令注入 severity: critical description: 检测 curl/wget 管道执行、反引号执行、$() shell 执行等风险 patterns: - 'exfiltrate\('
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Instruction Override

High

Category: Prompt Injection
Content: description: 检测提示注入、越狱指令、系统提示覆盖等风险 patterns: - 'ignore previous instructions' - 'ignore above all' - 'system prompt override' - 'ignore all previous'
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Instruction Override

High

Category: Prompt Injection
Content: description: 检测提示注入、越狱指令、系统提示覆盖等风险 patterns: - 'ignore previous instructions' - 'ignore above all' - 'system prompt override' - 'ignore all previous'
Confidence: 80% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Content: name: prompt_injection display_name: 提示注入 severity: critical description: 检测提示注入、越狱指令、系统提示覆盖等风险 patterns: - 'ignore previous instructions' - 'ignore above all' - 'system prompt override' - 'ignore all previous' - 'you are now a' - 'jailbreak' - 'DAN mode' - 'do anything now' - 'pretend to be' - 'override safety' - 'disable safety' - 'forget everything' - 'roleplay as an' - 'start over' - 'reset instructions' suggestion: 移除提示注入或越狱指令文本；如为文档示例，请添加 # nosec 注释 source: static
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: - 'you are now a' - 'jailbreak' - 'DAN mode' - 'do anything now' - 'pretend to be' - 'override safety' - 'disable safety'
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: - 'DAN mode' - 'do anything now' - 'pretend to be' - 'override safety' - 'disable safety' - 'forget everything' - 'roleplay as an'
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Instruction Override

High

Category: Prompt Injection
Content: - 'DAN mode' - 'do anything now' - 'pretend to be' - 'override safety' - 'disable safety' - 'forget everything' - 'roleplay as an'
Confidence: 90% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Content: def create_detector(use_ml=True): """Create a prompt injection detector.""" return PromptInjectionDetector(use_ml=use_ml)
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Credential Access

High

Category: Privilege Escalation
Content: merge them into the same report and scoring pipeline. High-risk signals: - Access to sensitive paths (~/.ssh, /etc/passwd, /etc/shadow, .aws, .env ...) - Outbound network to a non-whitelisted host/IP - Download-then-execute (network activity + exec/compile in the same run) - Spawning shells / interpreters (bash, sh, powershell, cmd)
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: merge them into the same report and scoring pipeline. High-risk signals: - Access to sensitive paths (~/.ssh, /etc/passwd, /etc/shadow, .aws, .env ...) - Outbound network to a non-whitelisted host/IP - Download-then-execute (network activity + exec/compile in the same run) - Spawning shells / interpreters (bash, sh, powershell, cmd)
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+1 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/taint_tracker.py:41

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/taint_tracker.py:41

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/taint_tracker.py:34

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:204