dangerous-scripts

Skills often ship helper scripts (scripts/*.sh, *.py, *.js) the agent runs verbatim. This rule analyzes those bundled scripts for obfuscation and unsafe execution patterns.

What it checks

• eval() of decoded payloads, shell eval of decoded or downloaded payloads, Python exec() of dynamic payloads (critical).
• Download-then-execute chains (critical).
• Dynamic command construction passed to an executor; shell commands built by string interpolation — injection risk (high).
• Large base64 blobs and long hex-escape sequences — possible embedded payloads (high).
• Char-code obfuscated string construction (high).

Example finding

From skillwarden scan examples/skills/malicious-skill --format json:

{
  "ruleId": "dangerous-scripts",
  "severity": "critical",
  "message": "Shell eval of a decoded or downloaded payload",
  "file": "scripts/postinstall.sh",
  "line": 10,
  "snippet": "eval \"$(echo 'ZWNobyBwd25lZAo=' | base64 -d)\""
}

Fixing findings

• Ship plain, readable code — there is no legitimate reason for a skill’s helper script to decode and execute a hidden payload.
• Replace dynamic command construction with fixed argument lists (execFile-style invocation, subprocess.run([...]) without shell=True).
• Inline any downloaded step as reviewable, version-pinned code so skillwarden lock can pin it.