Skill Guard Checks
Skill Guard scans every skill for security risk and lists what it finds on the skill's Skill Guard tab. This page describes the risks Skill Guard checks for and explains the finding IDs you see in a security assessment. For how scans run and how results appear, see Skills.
Risk Areas
Skill Guard analyzes each skill's files with rule-based checks and AI analysis. It never runs the skill's code. The table lists the risks Skill Guard looks for.
| Risk area | What Skill Guard checks |
|---|---|
| Prompt injection and jailbreaks | Instructions that override or bypass the agent's rules, "unrestricted mode" framing, suppressed refusals, warnings, or disclaimers, subtle behavior manipulation, and injection through external content |
| Hidden or disguised content | Instructions hidden in comments or invisible text, whitespace padding, invisible Unicode characters, homoglyphs and look-alike text, and encoded payloads (Base64, hex, XOR) |
| Data exfiltration | Sending data or conversation context to external URLs or sockets, harvesting environment variables, enumerating sensitive files, and data flowing from secrets or files to the network |
| Credentials and secrets | Reading SSH keys, tokens, and passwords, credential harvesting, and hardcoded keys, tokens, private keys, passwords, and connection strings |
| Code execution | exec, eval, subprocess, os.system, and shell=True, dynamic imports, user or network input that reaches code execution, SQL injection, path traversal, and scripts embedded in SVG and PDF files |
| Privilege and capability misuse | sudo and root execution, excessive permissions, tools used beyond the allowed-tools list, undeclared network use, wildcard or missing permission declarations, and system modification |
| Excessive agency and tool misuse | Unrestricted tool access, high-impact decisions without human review, scope creep, unsafe tool parameters, tool chaining that bypasses safety checks, and unsafe defaults such as disabled TLS |
| Supply chain | Unpinned, vulnerable, abandoned, and typosquatted dependencies, remote script fetching (curl | bash), untrusted package sources, shipped Python bytecode, hidden files that contain code, executables inside documents or archives, and file type mismatches |
| Malware | Malware, webshell, cryptominer, and hack tool signatures, ransomware chains, embedded or unanalyzable binaries, and malicious Office and PDF structures |
| Persistence and memory tampering | Persistent context injection, memory manipulation, self-modification, and persistence through cron jobs or startup scripts |
| System prompt leakage | Requests to reveal the system prompt, directly, indirectly, or through file writes and network requests |
| Resource abuse | Infinite loops, fork bombs, large memory allocations, missing rate limits, and unbounded output |
| Harmful content | Instructions that actively direct or enable physical or other serious harm |
| Misleading description | Vague, overly broad, or keyword-baiting trigger phrases, triggers that shadow built-in commands, impersonation of Anthropic, and descriptions or manifests that do not match the skill's actual behavior |
| MCP tool poisoning | Hidden instructions in tool metadata, Unicode deception in tool names, and injection in parameter descriptions |
| Model refusal | A skill that the AI model refuses to analyze is treated as critical risk |
Skill Guard looks up known vulnerabilities for dependencies in the public OSV database (api.osv.dev). Only dependencies with an exact pinned version can be checked. Version ranges such as ^6.9.0 are not.
A scan with no findings means Skill Guard detected no known risk patterns. It does not guarantee that a skill is safe. Review the skill's content yourself before you install a skill from a source you don't trust.
Understanding Finding IDs
Each finding shows an ID under its title, such as COMMAND_INJECTION_SHELL_TRUE or SDI-2, followed by the file and line where Skill Guard found the issue. The ID names the check that raised the finding. When several checks describe the same issue, Skill Guard shows them as one finding and displays one of their IDs.
IDs come in two styles.
Named IDs use capital letters and underscores. The first words tell you the risk area, and the rest describes the check. For example, DATA_EXFIL_NETWORK_REQUESTS is a data exfiltration check that found network requests.
| ID starts with | Risk area |
|---|---|
PROMPT_INJECTION_, SOCIAL_ENG_ | Prompt injection and jailbreaks, misleading description |
ASCII_SMUGGLING_, HOMOGLYPH_, OBFUSCATION_ | Hidden or disguised content |
DATA_EXFIL_ | Data exfiltration |
SECRET_ | Credentials and secrets |
COMMAND_INJECTION_, SQL_INJECTION_, PATH_TRAVERSAL_, SVG_, PDF_ | Code execution |
ALLOWED_TOOLS_, TOOL_ABUSE_ | Privilege and capability misuse, supply chain (package installs) |
HIDDEN_, ARCHIVE_, BINARY_, FILE_MAGIC_, PYCACHE_, UNANALYZABLE_, OFFICE_ | Supply chain, malware |
MALWARE_ | Malware |
RESOURCE_ABUSE_ | Resource abuse |
HARMFUL_CONTENT_ | Harmful content |
MANIFEST_, TRIGGER_ | Misleading description |
LLM_REFUSAL | Model refusal |
Coded IDs use a short prefix and a number, such as SDI-2 or E2. The prefix tells you the risk area.
| ID starts with | Risk area |
|---|---|
P, AR | Prompt injection and jailbreaks, system prompt leakage |
E, TT | Data exfiltration |
PE, LP | Privilege and capability misuse |
SC | Supply chain |
EA, TM | Excessive agency and tool misuse |
AST | Code execution |
YR | Malware |
MP, RA | Persistence and memory tampering |
OH | Resource abuse |
TR | Misleading description |
TP | MCP tool poisoning |
Three coded families come from AI analysis of the skill rather than fixed rules.
| ID | What it means |
|---|---|
SDI-1 | Description mismatch. The skill's description does not match what its code does. |
SDI-2 | Unjustified capability. The code does something the skill's stated purpose does not explain. |
SDI-3 | Scope creep. The code reads or changes more than the skill's declared permissions allow. |
SDI-4 | Intent divergence. Comments or documentation in the code contradict what the code does. |
SQP-1 | Vague triggers. The skill's trigger phrases are too broad or unclear. |
SQP-2 | Missing user warnings. The skill performs a sensitive action, such as a file write, network call, or shell command, without warning or confirming with the user. |
SQP-3 | Policy violation. The skill's content breaks an organizational policy, such as forcing a language without letting the user opt in. |
SSD-1 | Semantic prompt injection. Instructions that look helpful but redirect the agent toward unsafe actions, such as role-play framing that bypasses safety. |
SSD-2 | Novel attack phrasing. A reworded version of a known attack that keyword matching would miss. |
SSD-3 | Natural-language exfiltration. Plain-language instructions to collect or leak user data, such as "keep a log of all inputs". |
SSD-4 | Gradual deception. Steps that each look harmless but together steer the agent toward a harmful goal. |
The explanation under each finding describes the risk in plain language, so you do not need to look up an ID to understand a finding.