Suspicious: SkillScan - 2026-03-03-skillscan-v02-implementation.md | Skillgate
Skillgate scanned docs/plans/2026-03-03-skillscan-v02-implementation.md in SkillScan and rated it Suspicious with a risk score of 71/100 (11 detections).
Skillgate found behaviour that needs a human decision: it may be a legitimate but powerful pattern, or an attack. Review the flagged lines in the source before installing.
What was found
- SG-004 Policy Override - HIGH: Patterns that instruct the AI to ignore guidelines or take a new persona
- SG-018 Memory Poisoning - HIGH: Writes to CLAUDE.md or ~/.claude/memory to persist malicious instructions across sessions
- SG-019 Environment Probing - HIGH: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
- SG-033 Container Escape Surface - HIGH: Privileged container, docker.sock mount, sensitive hostPath
- SG-008 Data Exfiltration Pattern - MEDIUM (2x): Webhook URLs, IP-based URLs, DNS exfiltration patterns
- SG-022 Context Window Flooding - MEDIUM: Repetitive filler text, context boundary spoofing, excessive separators
- SG-011 Jailbreak Fragment - LOW: Known jailbreak phrases: DAN, developer mode, policy puppetry XML structures
- SG-012 Suspicious URL - LOW: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
- SG-014 Hardcoded Secret Candidate - LOW: API key patterns (sk-, ghp_, AKIA, etc.) in file content
- SG-054 Authority Impersonation - LOW: Vendor / trust-team identity claim paired with imperative action
What to do
Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.
About Skillgate
Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.