SG-108: Line-split obfuscated command
Severity: MEDIUM
A dangerous shell/exfil command hidden by splitting its tokens across newlines or zero-width chars, revealed only after de-wrapping. SkillCloak Disperse line-split class.
Fires when
- A dangerous command is hidden by splitting its tokens across line breaks or zero-width chars and becomes visible only after de-wrapping (SkillCloak Disperse), not in the raw text.
- The revealed command is a high-signal danger shape: curl/wget piped to a shell, curl/wget fetching a secret/credential path, a read of a private key, `rm -rf /`, or base64-decode piped to a shell.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.