agentleFS
Sign inStart free
EskyeeEskyee/agentbot-opensource/skills/aeon-skill-security-scan/SKILL.md

aeon-skill-security-scan

Skill17 starsChanged 5 months agoMITView on GitHub

Audit installed Bankr skills before you run them — scan SKILL.md and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and 2026-era obfuscation (zero-width Unicode, bidi override, base64-decode pipes, webhook SSRF hosts). Designed to integrate with Bankr Safety Scores. Silent on no-op runs; surfaces only NEW or RESOLVED findings vs prior scans. Triggers: "audit this skill", "is this skill safe to install", "security scan my skills", "check skill X for injection".

2 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 3 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈3

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Default <skills-dir> is the current working directory.

    line 23
  2. Distinctive:

    Never auto-deletes a baseline suppression.

    line 63
  3. Distinctive:

    Never edits the pattern library from inside the skill.

    line 64
  4. Distinctive:

    Never notifies on a pure no-op week.

    line 65

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

aeon-skill-security-scan

Skills tell agents what to do. A malicious or sloppy skill can shell-inject, exfiltrate secrets, override instructions, or run destructive commands. This skill scans every installed SKILL.md and companion script and surfaces the risks before they execute.

Scope

  • <skills-dir>/*/SKILL.md — primary.
  • <skills-dir>/*/scripts/*.sh and *.py — companion scripts.
  • <skills-dir>/*/references/* — documents loaded at runtime.

Default <skills-dir> is the current working directory.

Threat patterns

CategoryWhat it looks like
Shell injectionUnquoted variable expansion, eval, backticks, $(...) with user data.
Secret exfiltrationEnv vars or file contents piped to outbound HTTP.
Path traversal../.. chains, absolute paths reaching outside the skill dir.
Prompt override"Ignore previous instructions", persona swaps, instructions inside fetched content.
Destructive commandsRecursive deletes rooted at / or ~, device writes.
ObfuscationU+200B / U+FEFF / U+202E (Trojan Source), base64-decode-into-shell, SSRF hosts (ngrok, interact.sh, webhook.site, pipedream).

Processing

  1. Pattern scanner produces matches {file, line, pattern, severity}.
  2. Code-fence downgrade — matches inside fenced code blocks drop one tier. Real run: blocks are never downgraded.
  3. Baseline suppression — drop (file, pattern, line) tuples in scan-baseline.yml.
  4. Trusted-publisher filter — entries in trusted-publishers.txt get format-only validation. Opt-in only.
  5. Delta vs scan-state.json — fingerprint by sha256(file + line_content + pattern). Classify NEW / RESOLVED / PERSISTENT.

Per-finding remediation

PatternFix
eval / backticks / $(...) with variableQuote the variable; replace eval with a function.
curl with secret in URLMove secret into prefetch script; never interpolate into shell.
Path traversalAllow-list validation; reject absolute paths.
Prompt override phrasingDocumentation → baseline suppression; payload → delete the skill.
Recursive delete rooted at / or ~Scope to the skill's own working directory.
ObfuscationDelete unless documented and reviewed.

Output

Verdict CLEAN / ATTENTION / DEGRADED. Needs-attention section per NEW HIGH with one-line remediation. Resolved-since-last-scan section. Per-skill PASS / WARN / FAIL.

Written only when NEW, RESOLVED, or any current HIGH findings.

Rules

  • Never auto-deletes a baseline suppression.
  • Never edits the pattern library from inside the skill.
  • Never notifies on a pure no-op week.
  • Read-only scanning.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free