Rule reference

skillwarden scan runs six deterministic rule categories, aligned with real-world skills-ecosystem threats. Every rule works offline, never executes skill content, and produces reproducible results.

Rule	Catches
prompt-injection	“ignore previous instructions”, concealment (“don’t tell the user”), jailbreak roleplay, fake system markers, precedence claims
hidden-unicode	zero-width characters, bidi controls, Unicode tag block (invisible instruction smuggling), private-use areas
dangerous-commands	curl | bash, rm -rf /, reverse shells, disk-destructive commands, history tampering, persistence via cron/systemd
credential-leak	hardcoded AWS/GitHub/npm/OpenAI/Anthropic/Slack/Google tokens, private keys, JWTs (reported redacted)
exfiltration	env secrets in network requests, key-material reads (~/.ssh, ~/.aws), dead-drop endpoints (webhook.site & co), ephemeral tunnels
dangerous-scripts	eval/exec of decoded payloads, download-then-execute chains, large base64/hex blobs, command injection in bundled scripts

Severities: critical > high > medium > low. Gate on them with skillwarden scan --fail-on <severity> or skillwarden ci (default threshold: high).

Every finding carries ruleId, severity, message, file, and usually line and a snippet. Advisory categories in the advisory database mirror these rule IDs so advisories can be cross-checked at scan time.