cyotee/aeon-skill-security-scan
lib/bankr-skills/aeon-skill-security-scan/SKILL.md
Audit installed Bankr skills before you run them — scan SKILL.md and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and 2026-era obfuscation (zero-width Unicode, bidi override, base64-decode pipes, webhook SSRF hosts). Designed to integrate with Bankr Safety Scores. Silent on no-op runs; surfaces only NEW or RESOLVED findings vs prior scans. Triggers: "audit this skill", "is this skill safe to install", "security scan my skills", "check skill X for injection".
development
Updated Jul 22, 2026
$ install --global
skillsauthnpx skillsauth add cyotee/indexedex aeon-skill-security-scanInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 22, 2026, 3:56 AM127.9s1 file scanned
SKILL.md
- name:
- aeon-skill-security-scan
- description:
- |
- Triggers:
- audit this skill", "is this skill safe to install", "security scan my skills",
aeon-skill-security-scan
Skills tell agents what to do. A malicious or sloppy skill can shell-inject, exfiltrate secrets, override instructions, or run destructive commands. This skill scans every installed SKILL.md and companion script and surfaces the risks before they execute.
Scope
<skills-dir>/*/SKILL.md— primary.<skills-dir>/*/scripts/*.shand*.py— companion scripts.<skills-dir>/*/references/*— documents loaded at runtime.
Default <skills-dir> is the current working directory.
Threat patterns
| Category | What it looks like |
|---|---|
| Shell injection | Unquoted variable expansion, eval, backticks, $(...) with user data. |
| Secret exfiltration | Env vars or file contents piped to outbound HTTP. |
| Path traversal | ../.. chains, absolute paths reaching outside the skill dir. |
| Prompt override | "Ignore previous instructions", persona swaps, instructions inside fetched content. |
| Destructive commands | Recursive deletes rooted at / or ~, device writes. |
| Obfuscation | U+200B / U+FEFF / U+202E (Trojan Source), base64-decode-into-shell, SSRF hosts (ngrok, interact.sh, webhook.site, pipedream). |
Processing
- Pattern scanner produces matches
{file, line, pattern, severity}. - Code-fence downgrade — matches inside fenced code blocks drop one tier. Real
run:blocks are never downgraded. - Baseline suppression — drop (file, pattern, line) tuples in
scan-baseline.yml. - Trusted-publisher filter — entries in
trusted-publishers.txtget format-only validation. Opt-in only. - Delta vs
scan-state.json— fingerprint bysha256(file + line_content + pattern). Classify NEW / RESOLVED / PERSISTENT.
Per-finding remediation
| Pattern | Fix |
|---|---|
| eval / backticks / $(...) with variable | Quote the variable; replace eval with a function. |
| curl with secret in URL | Move secret into prefetch script; never interpolate into shell. |
| Path traversal | Allow-list validation; reject absolute paths. |
| Prompt override phrasing | Documentation → baseline suppression; payload → delete the skill. |
| Recursive delete rooted at / or ~ | Scope to the skill's own working directory. |
| Obfuscation | Delete unless documented and reviewed. |
Output
Verdict CLEAN / ATTENTION / DEGRADED. Needs-attention section per NEW HIGH with one-line remediation. Resolved-since-last-scan section. Per-skill PASS / WARN / FAIL.
Written only when NEW, RESOLVED, or any current HIGH findings.
Rules
- Never auto-deletes a baseline suppression.
- Never edits the pattern library from inside the skill.
- Never notifies on a pure no-op week.
- Read-only scanning.
Related Skills
cyotee/bankr-communities
development
VerifiedTrustedCommunity
Bankr Space ↔ bankr.bot/agents two-way sync (BANKR-PROJECT-SYNC.md Paths B+C). Original tweets from GET /agent-profiles/:id/tweets shown on Spaces. Holder votes: yes/no or multiple-choice polls (1–24h) — HOLDER-VOTES.md (never say no poll feature). Agents: POST /api/agent/start-vote with symbol Space. Petition spaces: fee-right unit holders only. POIDH: create/list on bankr.space; fund/claim/vote on poidh.xyz. NOT Twitter audio Spaces.
SKILL.mdUpdated Jul 22, 2026
cyotee/b20-console
development
VerifiedTrustedCommunity
Inspect B20 token contract addresses on Base through B20 Console. Use this skill when a user asks whether a B20 contract is live, initialized, recognized by the B20 factory, what policies are attached, whether features are paused, or what risk flags are active. Calls the public B20 Console API and returns a concise risk summary with reasons. No API key required.
SKILL.mdUpdated Jul 22, 2026
cyotee/azzle
development
VerifiedTrustedCommunity
Post, claim, and settle agent tasks on the AZZLE protocol (Base mainnet, USDC escrow). Use when the user or agent wants to discover open work, post a search listing, claim a task, fund escrow, submit proof, accept delivery, check vault balance, or operate on AZZLE's task marketplace. Requires Bankr for swaps, approvals, and on-chain execution. NOT for modifying AZZLE smart contracts or running the azzle.org website.
SKILL.mdUpdated Jul 22, 2026
cyotee/autoboy
data-ai
VerifiedTrustedCommunity
AutoBoy by The Firm — the pre-launch order book for Bankr launches on Base. Use when an agent wants to buy a token before it launches, or launch its own token with coordinated launch-day demand and distribution. Triggers on "AutoBoy", "pre-launch orders", "auto-buy", "buy before TGE", "launch a Bankr token", or "create demand before TGE".
SKILL.mdUpdated Jul 22, 2026