Security Scan

Heuristic scan of skill content for prompt-injection and malicious patterns.

Overview

A skill is text your agent trusts: its SKILL.md is read as instructions and its scripts run on your machine. Public research (Snyk's ToxicSkills, 2026) found prompt injection in roughly a third of tested community skills. This scan flags the known bad shapes across every installed skill, in every scope (user, project, codex, plugin):

• Injection phrases — "ignore all previous instructions", "do not tell the user"
• Hidden instructions — imperative text in HTML comments (invisible when rendered), zero-width/bidi unicode between plain characters
• Payload smuggling — large decodable base64 blobs in markdown
• Dangerous scripts — network piped into a shell (curl … | bash), decode-and-execute, credential-store access (~/.ssh, ~/.aws, keychain), URL shorteners, plain-HTTP calls, uploads of variable data

Findings are heuristics, not proof: a RISK verdict means "read this before trusting it". Legit tools trip these rules too (e.g. an installer that pipes curl into bash) — the point is that YOU see it and decide.

Prerequisites

• Claude Code with the skills-janitor plugin installed (provides scripts/security.sh)
• bash 3.2+ (the stock macOS bash works; no external dependencies, no network access)