29 builtin rules. Generated from crates/skillwright-scanner-core/rules/builtin/.
Every rule ships with test vectors that run in CI; a rule that fails its own
vectors is rejected at load time. Disable any of them with
skillwright-scanner rules disable <id> or a disabled_rules entry in .skillwright-scan.toml.
Instructs the agent to conceal actions from the user — Asks the assistant to hide what it is doing, which has no legitimate purpose in a skill.
Attempts to override prior instructions — Classic prompt injection: tells the agent to discard its existing instructions or safety rules.
injection.hidden-html-comment 
regex
Instructions concealed in an HTML comment — Directives inside HTML comments are invisible in rendered markdown but are still read by the agent.
Attempts to reassign the agent's identity — Tries to replace the assistant's persona or claim its restrictions no longer apply.
Treats fetched web content as instructions — Fetching a remote page and following it as instructions turns any attacker-controlled page into a prompt injection vector.
Remote code piped directly into a shell — Downloads a remote script and executes it in one step, so the code that runs is never reviewed and can change at any time.
Environment variables sent to the network — Reads the process environment and transmits it, which leaks every credential the agent has access to.
Data smuggled through a markdown image URL — A markdown image whose URL carries a long query string can silently transmit conversation data to a remote server when the image renders.
Local file uploaded to a remote endpoint — Uploads file contents to an external server, a common way to move credentials or source code off the machine.
Hardcoded Anthropic API key — A credential is committed directly in the skill. Anyone who installs it receives a working key.
Hardcoded AWS access key id — A credential is committed directly in the skill. Anyone who installs it receives a working key.
Hardcoded GitHub token — A credential is committed directly in the skill. Anyone who installs it receives a working key.
Hardcoded OpenAI API key — A credential is committed directly in the skill. Anyone who installs it receives a working key.
Hardcoded Slack token — A credential is committed directly in the skill. Anyone who installs it receives a working key.
Hardcoded Stripe secret key — A credential is committed directly in the skill. Anyone who installs it receives a working key.
Reads credential files — Accesses well-known credential stores such as cloud config, SSH keys, or the system keychain.
Reads .env files — Opens dotenv files, which typically hold API keys and database passwords.
High-entropy string may be a credential — A long random-looking token that does not match a known key format. Often a credential, sometimes a hash or test fixture.
Reverse shell — Opens an interactive shell back to an attacker-controlled host, handing over full control of the machine.
Dynamically decoded code is executed — Evaluates code that was decoded at runtime, which hides the real payload from review and from static scanners.
Programmatic shell execution — Spawns a shell from code. Legitimate in many skills, but it is the mechanism most abused to run arbitrary commands.
Persistence via system services or shell startup files — Modifies launch agents, cron, systemd units, or shell profiles, which lets a skill keep running after the session ends.
Executes financial transactions — Moves money or crypto assets. Legitimate for payment skills, but a high-impact capability worth surfacing explicitly.
Obfuscation & Hidden Content
Unicode tag characters — The U+E0000 block encodes a complete invisible ASCII alphabet, and is used to embed prompts that render as nothing at all.
Invisible zero-width characters — Zero-width characters are invisible in every editor but are still read by the model, so they can carry hidden instructions.
Bidirectional text control characters — Bidi overrides make displayed text differ from the underlying bytes, so a reviewer sees something other than what runs.
Large base64 blob — A long encoded blob hides its contents from review. Legitimate for embedded images, suspicious in instructions.
Long run of escaped unicode codepoints — Text written entirely as escape sequences is unreadable to a human reviewer but reconstructed by the runtime.
Mixed-script token (possible homoglyph) — Mixing Latin with Cyrillic or Greek letters inside one word is how lookalike domains and command names are spoofed.
These run on every file regardless of the enabled rule set, because they analyse extracted URLs rather than matching patterns:
| id | severity | fires when |
|---|---|---|
network.lookalike-domain |
critical | host is one edit away from a well-known domain (typosquat) |
network.raw-ip |
high | request targets a bare IP instead of a named host |
network.punycode |
high | punycode/IDN host that can visually impersonate another domain |
network.plain-http |
low | unencrypted HTTP to a non-local host |
localhost, 127.0.0.1, *.local, and *.internal are never flagged.