janitor-security

# Security Scan Heuristic scan of skill content for prompt-injection and malicious patterns. ## Overview A skill is text your agent trusts: its SKILL.md is read as instructions and its scripts run on your machine. Public research (Snyk's ToxicSkills, 2026) found prompt injection in roughly a third of tested community skills. This scan flags the known bad shapes across every installed skill, in every scope (user, project, codex, plugin): - **Injection phrases** — "ignore all previous instructions", "do not tell the user" - **Hidden instructions** — imperative text in HTML comments (invisible when rendered), zero-width/bidi unicode between plain characters - **Payload smuggling** — large decodable base64 blobs in markdown - **Dangerous scripts** — network piped into a shell (`curl … | bash`), decode-and-execute, credential-store access (`~/.ssh`, `~/.aws`, keychain), URL shorteners, plain-HTTP calls, uploads of variable data Findings are heuristics, not proof: a RISK verdict means "read this before trusting it". Legit tools trip these rules too (e.g. an installer that pipes curl into bash) — the point is that YOU see it and decide. ## Prerequisites - Claude Code with the skills-janitor plugin installed (provides `scripts/security.sh`) - bash 3.2+ (the stock macOS bash works; no external dependencies, no network access) ## Instructions ### Step 1: Run the scan ```bash bash ~/.claude/skills/skills-janitor/scripts/security.sh # all installed skills bash ~/.clau...