offensive-vuln-classes

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

• high Privilege Escalation · line 199
  Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
  Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
• high Privilege Escalation · line 200
  Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
  Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
• high Privilege Escalation · line 859
  Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
  Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
• high Privilege Escalation · line 860
  Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
  Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
• high Prompt Injection · line 206
  This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
  Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
• high Rogue Agent · line 206
  Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
  Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
• high YARA Match · line 206
  YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
  Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
• high Prompt Injection · line 235
  This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
  Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
• high Anti-Refusal · line 440
  Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
  Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
• high Anti-Refusal · line 452
  Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
  Fix: Remove jailbreak framing that nullifies safety policies or restrictions. Skill content must not instruct the agent to ignore its guidelines or operate without guardrails.
• high Prompt Injection · line 452
  This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
  Fix: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
• high Rogue Agent · line 452
  Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
  Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
• high YARA Match · line 789
  YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
  Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
• high Rogue Agent · line 828
  Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
  Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
• high Rogue Agent · line 859
  Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
  Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
• medium Excessive Agency · line 73
  Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
  Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
• medium Excessive Agency · line 337
  Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
  Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
• medium Excessive Agency · line 933
  Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
  Fix: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access.
• low Privilege Escalation · line 828
  Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
  Fix: Request only the minimum permissions required. Document why each permission is needed. Remove broad permissions like '*' or 'all'.
• low Privilege Escalation · line 836
  Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
  Fix: Request only the minimum permissions required. Document why each permission is needed. Remove broad permissions like '*' or 'all'.