SG-087: External binary/archive payload reference
Severity: HIGH
Instruction in a markdown/agent-config file routes the agent to extract or execute content from a binary/archive sibling whose contents are not visible to this scan. Indirection itself is signal; manual review of the referenced file is advised.
Fires when
- Instruction uses action verb (extract, decode, parse, run, eval) naming a binary/archive sibling (.pyc, .zip, .so, .wasm, .jar)
- Binary/archive described as containing instructions, payload, script, or config (noun-first phrasing)
- In SKILL.md: module invocations (python -m, npx) in code blocks skip unless staged in attacker paths (/tmp, ~/.cache, /dev/shm)
Remediation
Inline the actual behavior in the SKILL.md rather than offloading it to a binary blob. If the binary is genuinely required (e.g. a real PDF parser config), document its source and hash.