Audit Code

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:14 AM UTC
• Version: 1.1.1

Overview

This is a local code security scanner whose sensitive-looking strings are mostly detection signatures, not instructions to steal data.

Install only if you are comfortable letting the skill scan the selected project tree, including .env-like files, and treat its output as sensitive because it may display matched secrets. Be aware that package install names found in code may be checked against PyPI or npm over the network.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (67)

Credential Access

High

• Category: Privilege Escalation

Content

- **Dangerous function calls** -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc.
- **SQL injection** -- String concatenation/interpolation in SQL queries
- **Dependency risks** -- Known hallucinated package names, unverified installations
- **Sensitive files** -- .env files committed to git, credential files in repo
- **File permissions** -- Overly permissive chmod patterns
- **Exfiltration patterns** -- Base64 encode + network send, DNS exfiltration, credential file reads

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- **Dangerous function calls** -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc.
- **SQL injection** -- String concatenation/interpolation in SQL queries
- **Dependency risks** -- Known hallucinated package names, unverified installations
- **Sensitive files** -- .env files committed to git, credential files in repo
- **File permissions** -- Overly permissive chmod patterns
- **Exfiltration patterns** -- Base64 encode + network send, DNS exfiltration, credential file reads

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- **Dangerous function calls** -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc.
- **SQL injection** -- String concatenation/interpolation in SQL queries
- **Dependency risks** -- Known hallucinated package names, unverified installations
- **Sensitive files** -- .env files committed to git, credential files in repo
- **File permissions** -- Overly permissive chmod patterns
- **Exfiltration patterns** -- Base64 encode + network send, DNS exfiltration, credential file reads

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- **Dangerous function calls** -- eval, exec, subprocess with shell=True, child_process.exec, pickle deserialization, system(), gets(), etc.
- **SQL injection** -- String concatenation/interpolation in SQL queries
- **Dependency risks** -- Known hallucinated package names, unverified installations
- **Sensitive files** -- .env files committed to git, credential files in repo
- **File permissions** -- Overly permissive chmod patterns
- **Exfiltration patterns** -- Base64 encode + network send, DNS exfiltration, credential file reads

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

".sh", ".bash", ".zsh", ".ps1",
	".php", ".pl", ".lua",
	".yaml", ".yml", ".json", ".toml", ".xml",
	".env", ".cfg", ".conf", ".ini",
	".sql",
	".tf", ".hcl",
	".dockerfile",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

".sh", ".bash", ".zsh", ".ps1",
	".php", ".pl", ".lua",
	".yaml", ".yml", ".json", ".toml", ".xml",
	".env", ".cfg", ".conf", ".ini",
	".sql",
	".tf", ".hcl",
	".dockerfile",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

".sh", ".bash", ".zsh", ".ps1",
	".php", ".pl", ".lua",
	".yaml", ".yml", ".json", ".toml", ".xml",
	".env", ".cfg", ".conf", ".ini",
	".sql",
	".tf", ".hcl",
	".dockerfile",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

".sh", ".bash", ".zsh", ".ps1",
	".php", ".pl", ".lua",
	".yaml", ".yml", ".json", ".toml", ".xml",
	".env", ".cfg", ".conf", ".ini",
	".sql",
	".tf", ".hcl",
	".dockerfile",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

".sh", ".bash", ".zsh", ".ps1",
	".php", ".pl", ".lua",
	".yaml", ".yml", ".json", ".toml", ".xml",
	".env", ".cfg", ".conf", ".ini",
	".sql",
	".tf", ".hcl",
	".dockerfile",

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The file contains live network capability via urllib-based registry lookups, but the skill description is limited to code review for secrets, dangerous calls, and common vulnerabilities. Undeclared outbound network access expands trust and can surprise users, leak metadata about scanned content, or violate least-privilege expectations.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

"""
Shared pattern database for AI Agent Security skill suite.

Central registry of detection patterns derived from research notes 01-18
and examples 01-04. Used by vet-repo, scan-skill, and audit-code skills.
"""

import re
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional


class Severity(Enum):
	CRITICAL = "CRITICAL"
	HIGH = "HIGH"
	MEDIUM = "MEDIUM"
	LOW = "LOW"
	INFO = "INFO"


class Category(Enum):
	SKILL_INJECTION = "skill_injection"
	HOOK_ABUSE = "hook_abuse"
	MCP_CONFIG = "mcp_config"
	SECRETS = "secrets"
	DANGEROUS_CALLS = "dangerous_calls"
	EXFILTRATION = "exfiltration"
	EN

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

_obfuscation"
	INSTRUCTION_OVERRIDE = "instruction_override"
	SUPPLY_CHAIN = "supply_chain"
	FILE_PERMISSIONS = "file_permissions"
	CODE_BEFORE_REVIEW = "code_before_review"
	CONFIG_BACKDOOR = "config_backdoor"
	MEMORY_CORRUPTION = "memory_corruption"
	CONFUSED_DELEGATION = "confused_delegation"
	PERSISTENCE = "persistence"


@dataclass
class Pattern:
	name: str
	pattern: str
	severity: Severity
	description: str
	category: Category
	compiled: Optional[re.Pattern] = field(default=None, repr=False)

	def __post_init__(self) -> None:
		self.compiled = re.compile(self.pattern, re.IGNORECASE)


@dataclass
class Finding:
	pattern_name: str
	severity: Severity
	category: Category
	description: str
	file_path: str
	line_number: int
	matched_text: str
	context: str = ""


# -- Skill Injection Patterns --

Skill_Injection_Patterns: list[Pattern] = [
	Pattern(
		name="html_comment_with_commands",
		pattern=r"<!--[\s\S]*?(curl|wget|bash|sh|exec|eval|system|python|node|perl)[\s\S]*?-->",
		severit

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

name="github_pat",
		pattern=r"gh[pso]_[a-zA-Z0-9]{36,}",
		severity=Severity.CRITICAL,
		description="GitHub personal access token detected",
		category=Category.SECRETS,
	),
	Pattern(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

name="github_pat",
		pattern=r"gh[pso]_[a-zA-Z0-9]{36,}",
		severity=Severity.CRITICAL,
		description="GitHub personal access token detected",
		category=Category.SECRETS,
	),
	Pattern(

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Obfuscated Code

High

• Category: Supply Chain

Content

name="python_marshal_loads",
		pattern=r"marshal\.loads\s*\(",
		severity=Severity.MEDIUM,
		description="marshal.loads() -- deserializes Python code objects, rarely needed in normal code",
		category=Category.DANGEROUS_CALLS,
	),
	# Java / .NET / PowerShell

• Confidence: 90% confidence
• Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Obfuscated Code

High

• Category: Supply Chain

Content

name="python_marshal_loads",
		pattern=r"marshal\.loads\s*\(",
		severity=Severity.MEDIUM,
		description="marshal.loads() -- deserializes Python code objects, rarely needed in normal code",
		category=Category.DANGEROUS_CALLS,
	),
	# Java / .NET / PowerShell

• Confidence: 90% confidence
• Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

TUP|NODE_OPTIONS|GIT_SSH_COMMAND|PYTHONPATH|RUBYOPT|JAVA_TOOL_OPTIONS)\s*=",
		severity=Severity.HIGH,
		description="Environment variable hijack -- can intercept library loads, force code execution, or redirect commands",
		category=Category.DANGEROUS_CALLS,
	),
	# Credential store access
	Pattern(
		name="crypto_wallet_browser_creds",
		pattern=r"(Exodus|MetaMask|Electrum|wallet\.dat|Login Data|Cookies|Web Data|chrome.*User Data|\.mozilla/firefox)",
		severity=Severity.HIGH,
		description="Crypto wallet or browser credential store access -- credential harvesting indicator",
		category=Category.DANGEROUS_CALLS,
	),
]


# -- Exfiltration Patterns --

Exfiltration_Patterns: list[Pattern] = [
	Pattern(
		name="curl_post_sensitive_file",
		pattern=r"curl\s+[^\n]*(-d|--data)\s+[^\n]*(cat|<)\s+[^\n]*(\.ssh|\.aws|\.gnupg|\.kube|\.env|credentials|id_rsa|private)",
		severity=Severity.CRITICAL,
		description="Exfiltration -- sensitive file contents sent via curl POST",
		category=Category.EXFI

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="sensitive_file_read",
		pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
		severity=Severity.HIGH,
		description="Reading sensitive credential files",
		category=Category.EXFILTRATION,

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="sensitive_file_read",
		pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
		severity=Severity.HIGH,
		description="Reading sensitive credential files",
		category=Category.EXFILTRATION,

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="sensitive_file_read",
		pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
		severity=Severity.HIGH,
		description="Reading sensitive credential files",
		category=Category.EXFILTRATION,

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="sensitive_file_read",
		pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
		severity=Severity.HIGH,
		description="Reading sensitive credential files",
		category=Category.EXFILTRATION,

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="sensitive_file_read",
		pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
		severity=Severity.HIGH,
		description="Reading sensitive credential files",
		category=Category.EXFILTRATION,

• Confidence: 95% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="sensitive_file_read",
		pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
		severity=Severity.HIGH,
		description="Reading sensitive credential files",
		category=Category.EXFILTRATION,

• Confidence: 95% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="credential_path_access",
		pattern=r"(~/\.ssh/|~/\.aws/|~/\.gnupg/|~/\.kube/|~/\.netrc|~/\.docker/config\.json|~/\.npmrc|~/\.git-credentials|~/\.pypirc|/etc/shadow)",
		severity=Severity.MEDIUM,
		description="Reference to sensitive credential file paths",
		category=Category.EXFILTRATION,

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

),
	Pattern(
		name="credential_path_access",
		pattern=r"(~/\.ssh/|~/\.aws/|~/\.gnupg/|~/\.kube/|~/\.netrc|~/\.docker/config\.json|~/\.npmrc|~/\.git-credentials|~/\.pypirc|/etc/shadow)",
		severity=Severity.MEDIUM,
		description="Reference to sensitive credential file paths",
		category=Category.EXFILTRATION,

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/patterns.py:357

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/patterns.py:350