Suspicious: skillguard - security-rules.md | Skillgate

Skillgate scanned benchmarks/final/skills/asset1__agentnode-dev--skills-security-audit/references/security-rules.md in skillguard and rated it Suspicious with a risk score of 62/100 (28 detections).

Skillgate found behaviour that needs a human decision: it may be a legitimate but powerful pattern, or an attack. Review the flagged lines in the source before installing.

What was found

• SG-002 Credential Exfiltration - CRITICAL: Env var reads of sensitive credentials combined with outbound HTTP calls
• SG-004 Policy Override - CRITICAL (2x): Patterns that instruct the AI to ignore guidelines or take a new persona
• SG-018 Memory Poisoning - CRITICAL: Writes to CLAUDE.md or ~/.claude/memory to persist malicious instructions across sessions
• SG-020 Persistence Mechanism - CRITICAL: Crontab, rc files, systemd, LaunchAgents, SSH key injection, registry run keys
• SG-023 Permission Escalation - CRITICAL: Trust modification, settings bypass, sudo/root shells, cloud IAM privilege escalation
• SG-063 Anti-LLM-Scanner Directive - CRITICAL: Adversarial strings designed to suppress AI-driven static analysis (auto-promotes flag to malicious)
• SG-008 Data Exfiltration Pattern - HIGH: Webhook URLs, IP-based URLs, DNS exfiltration patterns
• SG-018 Memory Poisoning - HIGH: Writes to CLAUDE.md or ~/.claude/memory to persist malicious instructions across sessions
• SG-019 Environment Probing - HIGH: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
• SG-023 Permission Escalation - HIGH: Trust modification, settings bypass, sudo/root shells, cloud IAM privilege escalation
• SG-026 RAG Poisoning - HIGH: Instructions hidden in RAG documents, vector store manipulation, embedding attacks
• SG-028 File Exfiltration - HIGH (2x): Bulk file reads, credential file access, data staging via tar/zip/rsync/S3 upload
• SG-029 Semantic Trojan - HIGH: Malicious side effects disguised as legitimate tasks, concealment directives, hidden instruction blocks
• SG-042 Encoding Chain - HIGH (2x): URL-encoded / JSON-unicode-escape / hex-escape / multi-layer (rot13+base64) encodings whose decoded layer carries action verbs or sensitive paths.
• SG-043 Markdown Substructure Smuggling - HIGH: Directive-shaped content inside HTML comments, image alt/title, reference-link titles, footnote bodies, definition-list bodies, <details> blocks, or heading anchors.
• SG-009 Obfuscation: Base64 - MEDIUM: Base64-encoded strings >50 chars in non-documentation fields
• SG-011 Jailbreak Fragment - MEDIUM (2x): Known jailbreak phrases: DAN, developer mode, policy puppetry XML structures
• SG-012 Suspicious URL - MEDIUM: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-022 Context Window Flooding - MEDIUM: Repetitive filler text, context boundary spoofing, excessive separators
• SG-095 Secret Egress to External Sink - MEDIUM: Credential/secret moved to an external git remote, scp/rsync host, HTTP POST, or DNS channel
• SG-097 Fetch-and-Execute - MEDIUM: Network-fetched content executed as code (pipe-to-shell, process substitution, eval, render-then-run, download-then-run)
• SG-098 Agent Safety-Control Suppression - MEDIUM: Instruction to suppress safety warnings, skip confirmation, or hide actions from the user
• SG-099 Destructive Filesystem Wipe - MEDIUM: rm -rf of home/root/user-data, shred of files, find -exec destruction, or dd over a raw device
• SG-054 Authority Impersonation - LOW: Vendor / trust-team identity claim paired with imperative action

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.