Skillgate detection rules

All 102 static detection rules Skillgate runs against AI agent skill, hook, MCP and instruction files: prompt injection, hook RCE, credential exfiltration, tool poisoning, obfuscation, supply chain. Each rule lists when it fires.

CRITICAL (28)

• SG-001 Hook RCE: Shell commands in hooks object that can achieve RCE
• SG-105 Hook script exfiltrates prompt/transcript to external host: A Claude Code hook script (.claude/hooks/*.py|js|ts) reads hook input (prompt/transcript/tool I/O via stdin) and sends it to an external network sink. CRITICAL when hook input is read and shipped externally; MEDIUM when an external network call is present without an observed hook-input read.
• SG-004 Policy Override: Patterns that instruct the AI to ignore guidelines or take a new persona
• SG-002 Credential Exfiltration: Env var reads of sensitive credentials combined with outbound HTTP calls
• SG-003 Direct Command Injection: Skill content instructing AI to run Bash tool with dangerous arguments
• SG-020 Persistence Mechanism: Crontab, rc files, systemd, LaunchAgents, SSH key injection, registry run keys
• SG-023 Permission Escalation: Trust modification, settings bypass, sudo/root shells, cloud IAM privilege escalation
• SG-024 MCP Tool Poisoning: Malicious instructions in MCP tool descriptions, credential-capturing schemas, built-in tool shadowing
• SG-093 Ransomware: Encrypt-then-extort: recovery/shadow-copy destruction, ransom-note language, mass rename to ransomware extensions, or crypto-encryption co-located with destruction of the originals.
• SG-027 Lateral Movement: AWS/GCP/Azure cross-account pivots, SSH lateral movement, CI/CD token abuse, port forwarding
• SG-030 Conversation Hijacking: Credential phishing, social engineering redirects, impersonation, message interception, user deception
• SG-033 Container Escape Surface: Privileged container, docker.sock mount, sensitive hostPath
• SG-035 Kubernetes Privilege Escalation: k8s cluster-admin / host* / runAsUser:0 / allowPrivilegeEscalation
• SG-041 Unicode Tag Block Smuggling: Codepoints in U+E0000..U+E007F (invisible to renderers, read by LLM tokenizer)
• SG-058 Hook Config Lifecycle RCE: Hook lifecycle entry running shell, interpreter, or fetch-and-exec
• SG-059 LLM Env Redirect: Project-level env override of LLM base URL / API key / proxy / CA bundle to non-vendor host
• SG-070 LLM Env Redirect (env-line format): ANTHROPIC_BASE_URL / OPENAI_BASE_URL / *_API_KEY redirected to non-vendor host in .env / docker-compose / TOML / YAML apiBase
• SG-063 Anti-LLM-Scanner Directive: Adversarial strings designed to suppress AI-driven static analysis (auto-promotes flag to malicious)
• SG-064 Trust dialog tampered: trustDialog: false in .claude/settings.json removes the first-run trust prompt. An attacker who places this in a repo-level settings.json gets the agent to load without user confirmation - the same gap exploited by CVE-2025-59536 hook RCE.
• SG-067 Remote control at startup enabled: remoteControlAtStartup: true on hooks or skills lets an external controller drive Claude Code from the moment a workspace opens. Combined with workspace auto-load, this is full silent RCE-equivalent.
• SG-068 Permissions skip declared in config: dangerouslySkipPermissions: true is the JSON form of --dangerously-skip-permissions. SG-060 catches the CLI flag; this catches it being baked into the project config where every contributor inherits the bypass without typing the flag.
• SG-071 Hardcoded Provider Secret in Config: Hardcoded API keys / tokens / passwords / connection URIs in agent and MCP config files. Covers Supabase (sbp_, JWT), Postgres/MySQL/MongoDB/Redis URIs with embedded password, Tavily / Firecrawl / Brave / Context7 / ref-tools / TestSprite / OpenRouter branded keys, Pipedream MCP UUID endpoints, and JSON/env-line patterns where a sensitive-named key holds a high-entropy value.
• SG-072 Skill context-command injection: Backtick-prefixed dynamic-context shell directive `!`cmd`` embedded in a SKILL.md - executes before any consent prompt.
• SG-078 Skill frontmatter hook RCE: Skill ships its own lifecycle hook executing curl / wget / bash -c / python -c / Invoke- / eval.
• SG-084 Deep-Link Settings Injection: IDE / agent deep-link URLs (claude-cli://, cursor://, vscode://, windsurf://, codex://) carrying a `--settings=` / `settings=` / `hooks` / `command=` payload. This is the CVE-2025-59536 / CVE-2026-21852 attack vector (eager flag parser executes the settings JSON, including hooks, before the trust dialog).
• SG-088 Python bytecode contains sensitive strings: A .pyc bytecode file ships in the repo and embeds tokens that suggest credential theft, subprocess execution, or network exfiltration. The interpreter runs bytecode, not source - the visible .py may be a decoy.
• SG-090 Covert prompt exfiltration: Instruction file directs the agent to silently issue a network call carrying the user's prompt or conversation. The combination of a covertness directive ("silently", "do not mention") + an outbound verb (curl/wget/fetch) + a prompt-shaped variable ($USER_PROMPT, $prompt, $messages) in the same block is the prompt-exfil spyware shape observed in the wild.
• SG-100 Agent-propagated / credential exfiltration: Instruction file tells the agent to inject an outbound network call into every generated file, or to harvest environment secrets/credentials and POST them to an external host. Covers prompt-exfil variants that carry no covert keyword and no $USER_PROMPT token (real example: NiranjanJ2/permission-test .gemini/GEMINI.md, 2026-06).

HIGH (44)

• SG-005 Indirect Prompt Injection: Instruction sets embedded in metadata fields (description, name)
• SG-008 Data Exfiltration Pattern: Webhook URLs, IP-based URLs, DNS exfiltration patterns
• SG-107 Obfuscated dynamic code execution: Runtime-assembled code execution (getattr(__import__()), chained chr(), eval/exec of decoded content) that hides the payload from pattern scanners. SkillCloak Reify command-rewrite class.
• SG-006 Tool/Skill Poisoning: Skill description with action directives; autonomous skills with execution patterns
• SG-007 Tool Shadowing: Skill that references or overrides identically-named built-in tools
• SG-018 Memory Poisoning: Writes to CLAUDE.md or ~/.claude/memory to persist malicious instructions across sessions
• SG-019 Environment Probing: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
• SG-021 Prompt Leaking: Attempts to extract system prompts, tool definitions, MCP server lists, or capability boundaries
• SG-082 NPM Install-Hook Dropper: package.json with preinstall/install/postinstall/prepare hook that runs a local JS/TS/PY/SH file
• SG-025 Backdoor Trigger Phrase: Keyword triggers, password gates, staged execution, trust-building deception patterns
• SG-026 RAG Poisoning: Instructions hidden in RAG documents, vector store manipulation, embedding attacks
• SG-094 Resource Abuse (Cryptomining): Cryptomining / compute theft: miner binaries (xmrig, cpuminer, ...), the stratum protocol, known mining-pool hosts, miner-only CLI flags, or a Monero wallet address.
• SG-028 File Exfiltration: Bulk file reads, credential file access, data staging via tar/zip/rsync/S3 upload
• SG-029 Semantic Trojan: Malicious side effects disguised as legitimate tasks, concealment directives, hidden instruction blocks
• SG-031 Public Network Bind: Service or firewall rule binding to 0.0.0.0 / 0.0.0.0/0
• SG-032 Public Bucket / ACL: Storage bucket or object ACL granting public access
• SG-034 GitHub Actions Risky Trigger: pull_request_target with untrusted code execution
• SG-036 IAM Wildcard: IAM policy wildcards on Allow
• SG-038 Unsafe Deserialization: pickle.load / yaml.load / marshal / unserialize
• SG-040 Unauthenticated Network Service: Auth disabled / empty creds / trust-all in service config
• SG-051 Config-Path Supply Chain: package.json / setup.py / GHA workflow writing into AI-assistant config paths
• SG-060 IDE Auto-Approval / YOLO: autoApprove, runOn folderOpen, permission_mode bypass, --yolo, --dangerously-skip-permissions
• SG-061 Workflow Untrusted-Input AI Agent: GitHub Actions workflow combining risky trigger, AI-agent action, and untrusted-input interpolation (Comment-and-Control).
• SG-062 Markdown Image Credential Exfil: Markdown image URL templating a credential-named variable (EchoLeak / CamoLeak)
• SG-089 Rhetorical misdirection of package source: Corporate-policy framing ('audited', 'approved internal mirror') colocated with a package-registry / source mutation or a private-host URL. Manual review required because the same shape appears in legitimate enterprise configs.
• SG-042 Encoding Chain: URL-encoded / JSON-unicode-escape / hex-escape / multi-layer (rot13+base64) encodings whose decoded layer carries action verbs or sensitive paths.
• SG-043 Markdown Substructure Smuggling: Directive-shaped content inside HTML comments, image alt/title, reference-link titles, footnote bodies, definition-list bodies, <details> blocks, or heading anchors.
• SG-045 Conditional Trigger Variants: Date / git-remote / locale-gated activation paired with action verbs
• SG-046 Multi-Doc YAML / JSON-in-YAML: Multiple YAML documents in a single file, or YAML scalars that parse as JSON-with-directives.
• SG-050 Polyglot Detection: File is markdown plus a valid shell script (shebang, heredoc, or pre-amble curl|sh) or contains ANSI escape sequences.
• SG-055 Per-Tool Divergence Comments: HTML comments addressed to multiple AI assistants in one file, with at least one body containing an imperative.
• SG-047 Homoglyph / Confusable Substitution: Mixed-script tokens with visually-confusable codepoints whose normalized form is an imperative (UTS-39 style).
• SG-065 External CLAUDE.md load enabled: externalClaudeMd: true allows loading a CLAUDE.md from outside the repo, opening a memory-poisoning channel where attacker-controlled instructions persist across sessions (Cisco 'Persistent Memory Compromise in Claude Code', March 2026).
• SG-073 Dangerous git env-var injection: Setting GIT_EXTERNAL_DIFF / GIT_PAGER / GIT_EDITOR / GIT_SEQUENCE_EDITOR / GIT_SSH_COMMAND turns a benign git command into arbitrary RCE.
• SG-074 Subcommand chain overflow: Bash command chains >=40 subcommands; overflows MAX_SUBCOMMANDS_FOR_SECURITY_CHECK so deny-list rules never see the tail.
• SG-075 Agent tools lockdown to Bash-only: Agent/skill frontmatter `tools:` field restricted to Bash with no safe-read alternatives - pushes the agent off Read/Glob/Grep.
• SG-076 Skill description semantic lure: Skill `description:` contains broadening phrase ('any time', 'always', 'whenever') that triggers auto-invocation on nearly every user prompt, combined with model invocation NOT disabled.
• SG-077 Skill paths targeting secrets: `paths:` glob targets .env, credentials, *.pem, .ssh/, .aws/ or uses '**' overbroad scope.
• SG-079 Skill context-fork privilege escalation: `context: fork` + elevating `allowed-tools` (Bash, Write, Edit) - skill subagent crosses permission boundary the parent never approved.
• SG-080 Skill argument injection into preprocessor shell: Preprocessor block `!`...`` uses `$N` substitution with user-supplied arguments without shell escaping.
• SG-083 Cross-Agent Instruction File Poisoning: AGENTS.md / .cursorrules / .windsurfrules / .continuerules / .clinerules / .goosehints with policy-override, persistence, credential-read, or silent-exfil directives. These files are auto-loaded by AI coding agents on every chat request without user review.
• SG-086 MCP STDIO Argument Injection: MCP server declaration (mcpServers / servers entry) has `args` containing shell metacharacters ($(...), backticks, |, ;, &&), env-var expansion, or `--config=<URL>` pulling remote config. Vectors: CVE-2025-68143/-68144/-68145 (Anthropic git MCP), CVE-2026-30615 (Windsurf STDIO RCE).
• SG-087 External binary/archive payload reference: Instruction in a markdown/agent-config file routes the agent to extract or execute content from a binary/archive sibling whose contents are not visible to this scan. Indirection itself is signal; manual review of the referenced file is advised.
• SG-102 Char-Coded Endpoint to Network Sink: JS/TS host or URL assembled from charcode / atob / hex / numeric char-array decode that feeds a network sink (fetch, axios, http(s).request, WebSocket, XMLHttpRequest, net.connect, tls.connect, dgram, sendBeacon). Escalates to CRITICAL when two or more distinct decode primitives feed the same sink.

MEDIUM (23)

• SG-091 Hook auto-executes local script: Hook's command field points to a local script file (.sh / .bash / .py / .js etc) that auto-runs on a Claude Code lifecycle event. Severity is HIGH for SessionStart / SessionEnd (run every agent session).
• SG-106 Self-extracting skill (deferred self-generated payload): A skill runs a decoder/init step that generates a file and then instructs the agent to follow that same generated file (SkillCloak SFS packing). The runtime payload is out of scanned scope; this flags the linked run->generate->follow tell.
• SG-009 Obfuscation: Base64: Base64-encoded strings >50 chars in non-documentation fields
• SG-010 Obfuscation: Unicode: Zero-width characters and RTL override characters
• SG-108 Line-split obfuscated command: A dangerous shell/exfil command hidden by splitting its tokens across newlines or zero-width chars, revealed only after de-wrapping. SkillCloak Disperse line-split class.
• SG-011 Jailbreak Fragment: Known jailbreak phrases: DAN, developer mode, policy puppetry XML structures
• SG-012 Suspicious URL: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-013 Chain Injection: Cross-skill references forming multi-hop attack chains
• SG-022 Context Window Flooding: Repetitive filler text, context boundary spoofing, excessive separators
• SG-048 Variation Selector / Combining Mark Anomaly: High density of VS or combining-mark codepoints, or GlassWorm decoder fingerprint
• SG-054 Authority Impersonation: Vendor / trust-team identity claim paired with imperative action
• SG-044 Steganography Heuristic: Trailing-whitespace bit-pattern, first-char acrostic, or bold/italic format-marker entropy.
• SG-066 Extra usage telemetry enabled: extraUsageEnabled: true expands the telemetry payload that leaves the host. When combined with anything that influences the prompt (skills, hooks), the extra telemetry can leak prompt fragments to the vendor or - if BASE_URL is redirected - to an attacker.
• SG-109 MCP server credential/relay redirect: An mcpServers httpUrl/url to an external relay carrying a credential (MEDIUM), or to a known proxy-reseller/typosquat host (HIGH). Escalates over SG-017's flat LOW for the base-URL-MITM / credential-to-relay shape.
• SG-092 Command-file exfiltration shape: Instruction file (slash-command, sub-agent, hook, skill, or CLAUDE.md / .cursorrules) co-occurs an external HTTP egress verb, a hardcoded destination identifier, and an env-secret materialization within a single block. Severity is raised to HIGH when the file path is `.claude/commands/`, `.claude/agents/`, or the .codex/ equivalents - those paths are auto-trusted on user invocation.
• SG-103 Host+Port Beacon to Network Sink: A HOST constant and a PORT constant declared in close proximity are both consumed by a client-side network primitive (not a server bind). Escalates to HIGH on stealth ports (1337/4444/6666/9001/31337) or an opt-out env-gate near the sink.
• SG-095 Secret Egress to External Sink: Credential/secret moved to an external git remote, scp/rsync host, HTTP POST, or DNS channel
• SG-096 Secret Written to Served Path: Secret artifact copied into a web-served / public directory
• SG-097 Fetch-and-Execute: Network-fetched content executed as code (pipe-to-shell, process substitution, eval, render-then-run, download-then-run)
• SG-098 Agent Safety-Control Suppression: Instruction to suppress safety warnings, skip confirmation, or hide actions from the user
• SG-099 Destructive Filesystem Wipe: rm -rf of home/root/user-data, shred of files, find -exec destruction, or dd over a raw device
• SG-101 Safety-Override Frame: Instruction frame asserting that safety filters / guardrails / Constitutional AI are disabled, or that the model identity is overwritten (godmode, liberation protocol, soul-overwritten, shadow-clone). Gated to claude_md / skill / instruction_doc and to files classified as a skill. Escalates to HIGH on 2+ pattern hits.
• SG-104 External-Trust Trampoline: Agent-directed install from a deferred external URL + concealment (off-file payload / brand-impersonation supply-chain)

LOW (7)

• SG-014 Hardcoded Secret Candidate: API key patterns (sk-, ghp_, AKIA, etc.) in file content
• SG-015 Unusual Metadata: YAML fields not in the standard schema
• SG-016 Script Reference: Shell script path references in skill markdown
• SG-017 External MCP Server: MCP server URLs pointing outside localhost
• SG-037 Cleartext Secrets in Config: Cleartext secrets in env / config files
• SG-039 Weak Cryptography: MD5/SHA1/DES/RC4 in cryptographic context
• SG-081 Skill model downgrade: Skill `model:` field routes the step to an older / weaker-refusal model. Review-only signal.