Suspicious: recon-skills - SKILL.md | Skillgate

Skillgate scanned redteam/bb-local-toolkit/SKILL.md in recon-skills and rated it Suspicious with a risk score of 62/100 (12 detections).

Skillgate found behaviour that needs a human decision: it may be a legitimate but powerful pattern, or an attack. Review the flagged lines in the source before installing.

What was found

• SG-004 Policy Override - CRITICAL: Patterns that instruct the AI to ignore guidelines or take a new persona
• SG-019 Environment Probing - CRITICAL: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
• SG-033 Container Escape Surface - CRITICAL: Privileged container, docker.sock mount, sensitive hostPath
• SG-019 Environment Probing - HIGH: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
• SG-029 Semantic Trojan - HIGH: Malicious side effects disguised as legitimate tasks, concealment directives, hidden instruction blocks
• SG-034 GitHub Actions Risky Trigger - HIGH: pull_request_target with untrusted code execution
• SG-043 Markdown Substructure Smuggling - HIGH: Directive-shaped content inside HTML comments, image alt/title, reference-link titles, footnote bodies, definition-list bodies, <details> blocks, or heading anchors.
• SG-012 Suspicious URL - MEDIUM: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-076 Skill description semantic lure - MEDIUM: Skill `description:` contains broadening phrase ('any time', 'always', 'whenever') that triggers auto-invocation on nearly every user prompt, combined with model invocation NOT disabled.
• SG-098 Agent Safety-Control Suppression - MEDIUM: Instruction to suppress safety warnings, skip confirmation, or hide actions from the user
• SG-012 Suspicious URL - LOW: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-015 Unusual Metadata - LOW: YAML fields not in the standard schema

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.