Caveat verdict

ka88-agent-shield

88
🟢 Trusted
No high-risk patterns surfaced by the deep scan — automated capability review, not behavioral proof.

A security auditing skill that checks URLs for SSRF, analyzes content for prompt injection, and validates commands — all defensive operations consistent with its stated purpose as an agent security shield.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

0
security
90
transparency
70
maintenance

Findings (21)

Pattern match critical

Pipe-to-shell pattern (curl | sh) — supply chain attack vector

procedures/03-commands.md · code · curl https://example.com | sh

Pattern match critical

Pipe to sh — executes piped content as shell commands

procedures/03-commands.md · code · | sh

Pattern match critical

Instructs agent to hide actions from user

procedures/02-content-analysis.md · code · do not tell user

Pattern match critical

Pipe to bash — executes piped content as shell commands

procedures/03-commands.md · code · |bash

Pattern match critical

Pipe to python — executes piped content as Python code

procedures/03-commands.md · code · |python

Pattern match critical

Prompt injection — tries to override agent instructions

procedures/02-content-analysis.md · code · ignore previous instructions

Pattern match critical

Unicode homoglyph detected — uses lookalike characters to evade pattern matching

procedures/02-content-analysis.md · code

Pattern match high

Pipe-to-shell pattern (wget | sh)

SKILL.md · prose · downgraded · wget ... | sh

Pattern match high

Bash /dev/tcp — raw TCP connection via shell

config/patterns.yaml · prose · downgraded · /dev/tcp/

Pattern match high

<script> tag in markdown — potential code injection

procedures/02-content-analysis.md · prose · downgraded · <script>

Pattern match high

Hex-encoded string — possible obfuscated payload

procedures/02-content-analysis.md · code · \xE2\x80\x8B\xE2\x80\x8C\xE2\x80\x8D

Pattern match high

Possible hardcoded credential

scripts/scan-skill-scanner.sh · prose · downgraded · API_KEY="not-needed

Pattern match high

Accesses .ssh directory

procedures/04-self-audit.md · code · .ssh/

Pattern match high

Accesses sensitive system files

procedures/03-commands.md · prose · downgraded · /etc/passwd

Pattern match medium

References sudo — requests elevated privileges

config/patterns.yaml · prose · downgraded · Sudo

Pattern match medium

HTTP request to bare IP address — common in malicious payloads

config/ssrf-blocklist.yaml · prose · downgraded · http://169.254.169.254

Pattern match medium

DNS exfiltration — embeds data in DNS queries

procedures/03-commands.md · prose · downgraded · nslookup $(

Pattern match low

Base64 encoding/decoding

config/patterns.yaml · prose · downgraded · base64_decode

Pattern match low

Uses XMLHttpRequest — network access

config/patterns.yaml · prose · downgraded · XMLHttpRequest

Pattern match low

Popular HTTP library — network access

config/patterns.yaml · prose · downgraded · axios

Pattern match low

Opens WebSocket connection

config/patterns.yaml · prose · downgraded · WebSocket

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class A/B/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

No declared permissions — minimal attack surface.

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API