SG-006: Tool/Skill Poisoning
Severity: HIGH
Skill description with action directives; autonomous skills with execution patterns
Fires when
- The skill is marked user_invocable: false (autonomous) yet still contains directives to execute tools.
- Those directives invoke the Bash tool (curl/wget/eval) or the Write tool to overwrite config/credential files - tool execution with attacker-controlled arguments.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.