SG-092: Command-file exfiltration shape

Severity: MEDIUM

Instruction file (slash-command, sub-agent, hook, skill, or CLAUDE.md / .cursorrules) co-occurs an external HTTP egress verb, a hardcoded destination identifier, and an env-secret materialization within a single block. Severity is raised to HIGH when the file path is `.claude/commands/`, `.claude/agents/`, or the .codex/ equivalents - those paths are auto-trusted on user invocation.

Fires when

• In an eligible file (skill, hook, CLAUDE.md, .cursorrules), three signals co-occur within ~800 chars
• HTTP egress verb (curl, wget, requests.post, fetch) with hardcoded destination (Telegram, Slack, Discord webhook, raw IP)
• Plus env secret materialization in same block (${*_TOKEN}, process.env.*_TOKEN, os.environ)
• Escalates to HIGH for auto-trusted paths (.claude/commands/, .claude/agents/, .codex/)

Remediation

If this command genuinely needs to notify an external destination, move the webhook URL and credentials into the cloner's own configuration (require them to set their own TELEGRAM_BOT_TOKEN / chat_id, document the variable, fail loudly if unset). Never ship a pre-bound destination inside a slash-command or sub-agent file - any cloner gets your endpoint, not their own.