Scanner rules

The skill tells the agent to drop its existing instructions. This is the classic prompt-injection opener.

Fix: Remove the phrase. A skill should add guidance, never ask the agent to discard its system prompt.

The skill asks the agent to act without the user's knowledge.

Fix: Every side effect should be visible to the user. Remove the concealment instruction.

The skill tries to reassign the agent's identity or unlock a 'mode'.

Fix: Describe the task instead of redefining who the agent is.

Invisible tag characters can smuggle instructions the agent reads but humans cannot see.

Fix: Delete the invisible characters.

Markdown renderers hide HTML comments from people, but agents still read them.

Fix: Move the text into visible prose or delete it.

The skill references files that hold private keys or cloud credentials.

Fix: Skills should never need raw credentials. Use the tool's own auth flow or ask the user to provide a scoped token.

The skill collects every environment variable, which usually includes API keys and tokens.

Fix: Read only the specific variable you need, by name.

The skill sends data to a network endpoint.

Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.

The skill talks to a service commonly used to receive stolen data.

Fix: Remove the endpoint, or replace it with a documented API the user owns.

The same file reads secrets and sends data to a remote host.

Fix: Drop the secret access or pin the destination to an endpoint you control.

Remote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine.

Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill.

The command can wipe files, disks or shared history.

Fix: Scope the command to a temp directory the skill created, and confirm with the user first.

The skill builds code at runtime, which hides what actually runs.

Fix: Ship the real code as a file in the skill so it can be reviewed and hashed.

The skill changes startup files or schedulers, so code keeps running after the session ends.

Fix: Avoid modifying shell profiles or schedulers. If needed, print instructions for the user instead.

The skill uses sudo.

Fix: Prefer user-level installs. If root is unavoidable, explain why next to the command.

Bidi control characters make text render differently from what the agent reads (Trojan Source).

Fix: Remove the bidi control characters.

Zero-width characters split keywords to dodge review.

Fix: Remove them.

A long base64 or hex string can hide a payload from review.

Fix: Replace the blob with the readable source, or explain what it is and include its checksum.

Installing without a version means a future malicious release lands automatically.

Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3).

The dependency is fetched from a mutable URL or branch.

Fix: Pin to a commit SHA or a published version with a checksum.

A compiled program cannot be reviewed as text.

Fix: Ship source, or document the binary's origin with a checksum.

An archive hides its contents from review and from the scan.

Fix: Commit the extracted files instead.

allowed-tools grants any shell command without confirmation.

Fix: Scope it, for example Bash(git status:*).

The skill turns off the agent's permission checks.

Fix: Remove the flag. Let the user decide which tools run without confirmation.

Agents cannot index a SKILL.md without YAML frontmatter.

Fix: Add name and description between --- lines.

Agents use the description to decide when to load the skill.

Fix: Add both fields.

Too short and the skill loads at the wrong time; over 1024 characters gets truncated.

Fix: Say what it does and when to use it.

Names should be lowercase letters, digits and hyphens, at most 64 characters.

Fix: Rename it, for example pdf-tools.

Long skills spend context on every load.

Fix: Keep it under 500 lines; move reference material into linked files.

A linked file is missing from the skill.

Fix: Add the file or fix the link.