SG-050: Polyglot Detection
Severity: HIGH
File is markdown plus a valid shell script (shebang, heredoc, or pre-amble curl|sh) or contains ANSI escape sequences.
Fires when
- The markdown/skill file begins with a shell shebang line (#!/bin/bash, #!/usr/bin/env python, etc.), making it executable if run directly
- The file opens with a heredoc (`: <<'EOF'` or similar) with a matching closing tag later, so it parses as both markdown and a no-op shell script
- Before any markdown heading, the first significant line is a curl|sh or wget|bash style fetch-and-execute command outside a code-block fence
- Contains ANSI/CSI terminal escape sequences that can make the terminal display differ from what a file viewer shows
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.