skill-injection-scanner

README / SKILL.mdから機械抽出できたコマンドのみ表示しています。推測したコマンドではありません。

- Remote fetch-and-run (`curl | bash`, `git clone … && run`), instruction extraction from attachments/images
- Manipulation tricks («this is critical: ignore…», emoji-boosted commands)
Context-aware scoring: security docs that *describe* injections, «show, don't tell» writing advice,
code-span examples and trusted hosts (github.com, docs.python.org, …) are not flagged; unknown
hosts stay HIGH with a «verify the source» note. `--self-test` exits 1 if `fixtures/` are missing
— it can never report a fake green. Note: the packaged copy has no `fixtures/` (marketplace policy);
run `--self-test` from the git repo, which ships them.
| What | Where | How to delete |
|---|---|---|
| Read file contents of the folder you point at | in memory only | nothing is written; findings go to stdout |
| Findings (file:line, rule, snippet) | stdout / `--format json` | close the terminal / redirect to a file and delete it |
Get explicit consent before scanning a folder: tell the user what will be read. The tool writes
nothing, phones nothing and keeps no logs.
- **Files**: read-only access to the skills directory the user explicitly points at.
- **Process**: none — no subprocesses, no installs, no shell execution.
- **Network**: NONE.
- **Secrets**: never reads secret/config files by design; a credential-looking pattern inside a
scanned file is reported as a finding with a short snippet for local rev