plugin-security

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill contains explicit example instructions and hook-script snippets that tell the agent to read sensitive files or environment variables and include/post them verbatim (e.g., read ~/.ssh/id_rsa, post ~/.aws/credentials, post "$(env)"), which directly enables secret exfiltration.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Multiple URLs point to unknown/attacker-controlled domains (used in the file as endpoints for credential/environment exfiltration) and one telemetry endpoint used for the same purpose, which are high-risk indicators for data theft or delivery of malicious payloads.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The SKILL.md contains multiple explicit examples and instructions demonstrating data exfiltration, credential harvesting, persistent backdoors, remote command execution, permission-escalation misuse, and obfuscation/evasion techniques — all high-risk patterns if embedded in a real skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill contains explicit hook-script examples that perform state-changing actions (credential exfiltration, appending an SSH key to ~/.ssh/authorized_keys, dumping environment, and unrestricted file writes), which — if executed — would compromise the host.