code-score

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:05 AM UTC
• Version: 1.0.0

Overview

The package presents its skill instructions, README, and configuration as Markdown, but they are opaque binary data, so the skill's behavior cannot be reviewed.

Do not install this version unless the publisher replaces the opaque files with complete plain-text, reviewable instructions and configuration, or provides a documented decoder and reviewed canonical content digest.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

other

Error

• Location: SKILL.md:1
• Finding: Obfuscated Binary Content in the Skill Definition<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1-11` **Vulnerability Type**: Binary content obfuscation **Risk Level**: High ### Evidence The file has a Markdown extension but begins with binary data, contains extensive NUL padding, and continues with high-entropy bytes rather than readable Skill instructions. ```text SKILL.md:1: }\x1c<l\x00\x10\x00Vst\x00"KU... SKILL.md:2-11: [high-entropy binary content and non-text bytes] ``` Attempts to read the file as text failed because it could not be decoded. A repository-wide content scan confirmed that all available lines contain opaque binary data rather than valid Markdown. ### Technical Analysis `SKILL.md` is the primary source used to communicate a Skill's instructions and intended behavior. Storing its contents in an opaque binary representation prevents reviewers from validating its goals, safety constraints, tool-use instructions, data-handling behavior, and external interactions. The mismatch between the `.md` extension and the file's actual content constitutes deliberate content obfuscation. A specialized loader or undocumented decoding stage could interpret content that ordinary source-review tools cannot inspect. The concealed payload itself was not recovered, so no specific hidden command, endpoint, or malicious instruction can be asserted. ### Attack Path 1. A user or platform accepts the package based on its apparent Markdown-only structure. 2. Static review tools fail to decode `SKILL.md` and cannot inspect its effective instructions. 3. A specialized package loader or undocumented decoder processes the opaque bytes. 4. Any recovered instructions could then affect agent behavior without having undergone meaningful source review. Steps 3 and 4 are conditional because no decoder or executable component was present in the reviewed artifact. ### Impact Assessment The confirmed impact is loss of auditability and bypass of ordinary text-based security controls. If the content is ...[truncated 300 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the file with canonical, plain UTF-8 Markdown containing the complete Skill instructions. 2. Remove NUL padding, binary encoding, encrypted content, compressed payloads, and undocumented transformations. 3. If transformation is genuinely required, document the format and publish the decoder's complete source code for review. 4. Add package validation that rejects `.md` files containing NUL bytes, invalid UTF-8, excessive control characters, or anomalously high-entropy content. 5. Require security review of the decoded canonical content and verify its digest before loading. 6. Fail closed when Skill instructions cannot be decoded as valid UTF-8 Markdown. ]]>

other

Warning

• Location: README.md:1
• Finding: Obfuscated Binary Content in User-Facing Documentation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:1-29` **Vulnerability Type**: Binary content obfuscation **Risk Level**: Medium ### Evidence The purported README contains binary data, extensive NUL padding, and high-entropy byte sequences instead of readable documentation. ```text README.md:1: }\x1cl\x00\x10\x00!7HG... README.md:2: [extensive NUL-padded binary content] README.md:3-29: [high-entropy binary content and non-text bytes] ``` Direct text decoding failed, and the repository-wide scan did not recover valid Markdown instructions. ### Technical Analysis A README normally describes installation, configuration, permissions, dependencies, and operational behavior. Obfuscating this material prevents users and reviewers from verifying what the package claims to do or identifying unsafe setup procedures. The hidden content was not decoded during the audit. Consequently, no specific installation command, malicious URL, dependency, or execution mechanism is confirmed. The security defect is the deliberate concealment and resulting review bypass. ### Attack Path 1. A user treats `README.md` as benign documentation based on its filename. 2. Standard Markdown readers and audit tools cannot decode or inspect the file. 3. An external or specialized consumer may process the opaque representation. 4. Undisclosed setup or usage instructions could be presented or acted upon without prior review. The final two steps remain conditional because the reviewed project contains no documented decoder. ### Impact Assessment The confirmed scope is restricted to documentation integrity and auditability. Users cannot validate installation requirements, requested permissions, or usage instructions. If another component decodes the file, concealed content could mislead users into unsafe actions, but no concrete command execution or privilege gain was demonstrated from the available evidence. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the opaque file with complete plain UTF-8 Markdown. 2. Clearly disclose installation commands, external services, required permissions, dependencies, and data-handling behavior. 3. Reject Markdown files containing NUL bytes, invalid character sequences, or unexplained binary payloads during packaging and continuous integration. 4. Remove undocumented encodings and provide cryptographic checksums for canonical reviewed documentation. 5. Require manual review whenever generated documentation differs from the source committed to the package. ]]>

other

Error

• Location: config.md:1
• Finding: Obfuscated Binary Content in Configuration Documentation<![CDATA[ ## Vulnerability Details **File Location**: `config.md:1-9` **Vulnerability Type**: Binary content obfuscation **Risk Level**: High ### Evidence The configuration file is not readable Markdown. It begins with binary bytes, includes a large NUL-padded region, and contains high-entropy data across the remaining lines. ```text config.md:1: }\x1cl\x00\x10\x00G... config.md:1: [extensive NUL-padded binary content] config.md:2-9: [high-entropy binary content and non-text bytes] ``` No readable configuration keys, values, endpoints, credentials, or security controls could be recovered. ### Technical Analysis Configuration can control endpoints, permissions, credentials, tool access, and runtime behavior. Concealing it behind an undocumented binary representation prevents validation of these security-sensitive settings and defeats ordinary secret scanning and policy enforcement. The audit did not recover the concealed data and therefore does not claim that the file contains credentials, malicious endpoints, or executable settings. The confirmed issue is that the configuration cannot be independently inspected or validated. ### Attack Path 1. The package is accepted because `config.md` appears to be ordinary Markdown. 2. Static scanners cannot parse its binary representation or enforce configuration policies. 3. A specialized loader may decode the data during package use. 4. Decoded settings could influence runtime behavior without having been visible during review. Runtime interpretation is conditional because no decoder or executable code was included in the reviewed directory. ### Impact Assessment The confirmed impact is the inability to validate security-sensitive configuration or detect prohibited values. If an external loader consumes the concealed content, it could potentially change agent behavior or external interactions. No specific privileges, credentials, network destinations, or execution capabilities were confirmed. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the file with plain UTF-8 Markdown or a documented, schema-validated format such as JSON, YAML, or TOML. 2. Prohibit encrypted, compressed, or otherwise opaque configuration unless the complete transformation process is documented and reviewed. 3. Define an allowlisted schema covering permitted keys, value types, endpoints, and privilege requirements. 4. Add secret scanning and reject embedded credentials, tokens, private keys, and plaintext sensitive data. 5. Validate decoded content before use and fail closed if the configuration cannot be parsed in its declared format. 6. Bind the runtime configuration to the reviewed version with a cryptographic digest or signed manifest. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence
• Finding: Artifact content does not match its filename extension

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence
• Finding: Artifact content does not match its filename extension

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence
• Finding: Artifact content does not match its filename extension

Static analysis

No suspicious patterns detected.