First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
4
Score
76/100
Findings (4)
Detects fetching external URLs and using the content as agent instructions or rules
Fetch heartbeat instructionsSanitize or validate all external inputs (file contents, API responses, user messages) before including them in prompts or tool calls. Implement input/output boundaries between trusted and untrusted data.
Likely FP if the matched text is the skill's own instruction set describing how to handle user input, not an actual injection payload.
Detects reads of sensitive system or credential files
cat ~/.configPrevent the tool from reading environment variables and sending them to external endpoints. If env access is needed, restrict it to specific variable names via an allowlist.
Likely FP if the match is documentation about how to configure environment variables, not code that reads and transmits them.
Detects fetching external URLs and using the content as agent instructions or rules
Fetch heartbeat instructionsSanitize or validate all external inputs (file contents, API responses, user messages) before including them in prompts or tool calls. Implement input/output boundaries between trusted and untrusted data.
Likely FP if the matched text is the skill's own instruction set describing how to handle user input, not an actual injection payload.
Detects pip install of arbitrary packages that modify the host environment
pip install chPin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.
Likely FP if the match is in documentation showing how to install the skill's own PyPI package.