+ lHjd Rt^RIt^RIt^RIt^RIt^RIHt^RIHtH t H t ^RI H t H t H t ^RIHt^RIHtHtRt0RmtRRR RR RR R/tR ^R ^R^/t] !RR44t] !RR44tRtRtRtRtRRltRRltRRltRt Rt!Rt"R t#R!t$R"t%R#t&R$t'R%t(R&](,R',t)R(]),R),t*.RNRNRNRNRNRNRNRNRNRNRNRNRNR-]),R.R*R+R/3NR0]*,R1,R2,]*,R3,R4R*R+R53NRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNRNERNERNERNERNERNERNERNR9]& R:2R;R*R7R<3NERNERNER NER NER NER NER NERNR>]& R?2R@R*R=RA3NERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNERNER NER!NER"NER#NER$NER%NRD]' ]& 2RER*RFRG3NRH]' ]& 2RIR*RFRJ3NRD]' RK2RLR*RFRM3NER&NER'NER(NER)NER*NER+NER,NER-NER.NER/NER0NER1NER2N]!]4ROR*R6RP3N]!]4RQR*R6RR3N]!]4RSR,R6RT3NER3N]!]4RUR,R6RV3N]!]4RWR*R6RX3NER4N]!]4RYR,R6RZ3N]!]4R[R*R6R\3NER5NER6NER7NER8NER9NER:NER;NERNER?NER@NERANERBNERCNR]] ]! R^] ]" R_]# R`]$ Ra]% Rb2 RcR,R+Rd3NERDNt+]+UUu.uF$vr]PYV]PZ4.VO5NK& uppt.]/!0EREm4t0/ReRfbRgRfbRhRfbRiRfbRjRfbRkRfbRlRfbRmRfbRnRfbRoRfbRpRfbRqERFbRrERFbRsRtbRuRtbRvERGbt1]PX!Rw]PZ4t2]PX!Rx]PZ4t3]PX!Ry4t4RzR{lt5R|R}lt6^2R~Rut7t8t90ERHmt:0ERImt;0ERJmt!]=4t?RCRB0t@RRltARRltBRRltC]PX!R4tD]PX!R4tERRltFERKRRlltG]/!RNR804tHRRltIERLRRlltJRRltKRRltLERLRRRR/RRllltMERMRRlltNRRltOERNRRlltPEROtQRRltRERPtSRRltTRRltURRltVR#uuppi(QugSkills Guard — regex static scan of externally-sourced skills plus a trust-aware install policy. Trust: builtin (never scanned), trusted (openai/anthropics/... repos: caution allowed), community (any findings block unless --force). ``scan_skill`` -> ``should_allow_install`` -> ``format_scan_report``. Known gap: language write APIs (open(..., 'w'), Path.write_text, shutil.copy*, fs.writeFileSync) aimed at agent-config files surface only the low *_ref finding — static regexes cannot tie the call to a dynamic destination; future coverage belongs as a fourth "mechanical" tier next to agent_config_mod_shell.N)suppress)asdict dataclassfield)datetimetimezoneUTCPath)ListTuplezskills-guard-v10builtintrusted community agent-createdsafecaution dangerousc,a]tRt^&toV3RltRtVtR#)Findingcn<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&S[;R&#) pattern_idseveritycategoryfilelinematch description)strint)format __classdict__s"7/home/ubuntu/.hermes/hermes-agent/tools/skills_guard.py __annotate__Finding.__annotate__&sXOMM  I  I  JN)__name__ __module__ __qualname____firstlineno____annotate_func____static_attributes____classdictcell__r"s@r#rr&sr&rcXa]tRt^1to]!]R7tRtRt]!] R7t V3Rlt Rt Vt R#) ScanResult)default_factoryc<V^8dQh/S[;R&S[;R&S[;R&S[;R&S[S[,;R&S[;R&S[;R&S[;R&#) r skill_namesource trust_levelverdictfindings scanned_atsummaryscan_provenance)rlistrdict)r!r"s"r#r$ScanResult.__annotate__1slO K  L  7m9 7r&r'N)r(r)r*r+rr=r9r:r;r>r<r,r-r.r/s@r#r1r11s, $D9HJG!$7Or&r1a0(?:\bwrit(?:e|es|ing)\b|\bwritten\b|\bedit(?:s|ed|ing)?\b|\bmodif(?:y|ies|ied|ying|ication)s?\b|\bupdat(?:e|es|ed|ing)\b|\bappend(?:s|ed|ing)?\b|\bprepend(?:s|ed|ing)?\b|\binject(?:s|ed|ing)?\b|\boverwrit(?:e|es|ing)\b|\boverwritten\b|\breplac(?:e|es|ed|ing)\b|\balter(?:s|ed|ing)?\b|\badd(?:s|ed|ing)\b)z4(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)z"\.hermes/(?:config\.yaml|SOUL\.md)z(\.(?:claude/settings|codex/config)[\w.]*c0V^8dQhR\R\/#rfile_altreturnr)r!s"r#r$r$Ms M Mc Mc Mr&c  RV RV RV RV R2 #)aMechanical shell write into *file_alt*: ``>``/``>>``, ``sed -i``, ``tee`` (target as immediate argument, so ``| tee output | AGENTS.md |`` cells miss), ``cp``/``mv`` with the file as destination (source arg required, so ``cp AGENTS.md backup/`` misses; ``AGENTS.md.bak`` is not the file). A single ``>`` needs a preceding word/quote/ paren char so blockquotes (``> text``) and arrows (``-> file``) miss.z"(?:>>|[\w"\'`)\]]\s*>)\s*[~\w./-]*zD(?!\.?\w)|\bsed\b[^\n]*\s(?:-[A-Za-z]*i[A-Za-z]*|--in-place)\b[^\n]*z((?!\.?\w)|\btee\s+(?:-a\s+)?[~\w./"\'-]*z3(?!\.?\w)|\b(?:cp|mv)\s+[^\s|;&]+\s+[^\n|;&]{0,40}?z (?!\.?\w)r'rBs&r#_shell_write_rerGMs9 .hZ8GGOjQ++3*588@z LMr&c0V^8dQhR\R\/#rArD)r!s"r#r$r$Ys99s9s9r&c 0R\ RV R\ RV R2 #)uLProse instructing modification of *file_alt*: an imperative-position verb (line start / bullet), or a mid-line verb with a directive marker ("you must", "please", "make sure to"). Descriptive prose ("skills that edit AGENTS.md") misses; the verb→file gap forbids commas so enumerations ("Write skills, AGENTS.md, CLAUDE.md") miss.z^\s*(?:[-*+]\s+|\d+[.)]\s+)?z [^\n,]{0,80}?zl\b|(?:\byou\s+(?:must|should|need\s+to)\s+|\bplease\s+|\bmake\s+sure\s+(?:to\s+|you\s+)|\bbe\s+sure\s+to\s+)z\b)MODIFY_VERB_RErFs&r#_prose_modify_rerKYs3 ('7xjQB  ?8*B 89r&c0V^8dQhR\R\/#rArD)r!s"r#r$r$dsmm3m3mr&c V R2#)u" should contain/include ..." prose. Authoring guides and attacks share this shape and are not separable statically, so the tier is scored high (caution → confirmation), never critical.zQ\b[^\n]{0,40}?\b(?:should|must|needs?\s+to)\s+(?:contain|say|include|have|list)\br'rFs&r#_content_contract_rerNdsjk llr&zw(?!(?:\w+\s+){0,4}?(?:never|not|no|doesn\'?t|didn\'?t|won\'?t|isn\'?t|aren\'?t|can\'?t|cannot|mustn\'?t|shouldn\'?t)\b)z(?:\w+\s+){0,3}?z(?!(?:(?:the|your|each|every|all|to|a)\s+)?(?:sub-?agents?|sub-?tasks?)\b|(?:(?:the|your|each|every|all|to|a)\s+)(?:workers?|delegates?|children|child)\b)z(?:your|their|our|its|the\s+(?:full|entire|whole|complete|current)|full|entire|whole|complete|current|conversation|session|chat)\s+z(?:\s+(?:to|at|with)\b)z&(?:[a-z]+s\s+)(?:the|a|an)\s+context\bz(?:bash|sh|zsh|ksh|dash)\bz(?:sudo\s+(?:-\S+\s+)*)?zs(?:\.ssh[/\\]id_(?:rsa|ed25519|ecdsa|dsa)(?!\.pub)|\.env\b|credentials\b|\.netrc\b|\.pgpass\b|\.npmrc\b|\.pypirc\b)z["\'][^"\'\n]*z[^"\'\n]*["\']z!(?:os\.path\.expanduser\s*\(\s*)?z\s*\)?critical exfiltrationhighz,\b(?:readFile(?:Sync)?|readTextFile)\s*\(\s*js_read_secrets_filez(JavaScript reads a known credential filez\bopen\s*\(\s*zV(?!\s*\)?\s*,\s*["\'][^"\']*[wax][^"\']*["\'])(?![^\n]*\bmode\s*=\s*["\'][^"\']*[wax])z|\bPath\s*\(\s*z7\s*\)\.(?:read_text|read_bytes|readlines|readline)\s*\(py_read_secrets_filez$Python reads a known credential file persistencenetworkbind_all_interfacesz/bin/z\s+-i\s+.*>/dev/tcp/bash_reverse_shellz+bash interactive reverse shell via /dev/tcp obfuscationzecho\s+[^\n]*\|\s*(?:z|python|perl|ruby|node)echo_pipe_execz'echo piped to interpreter for executionpath_traversal_deeppath_traversalzcurl\s+[^|\s][^\n]*\|\s*curl_pipe_shell supply_chainz*curl piped to shell (download-and-execute)zwget\s+[^\n]*-O\s*-\s*\|\s*wget_pipe_shellz*wget piped to shell (download-and-execute)pythoncurl_pipe_pythonz curl piped to Python interpreter sudo_usageagent_config_modzYinstructs modification of agent config files (could persist instructions across sessions)agent_config_mod_shellz\shell write (redirect/sed -i/tee/cp/mv) targeting agent config files (persistence mechanism)agent_config_contractu[dictates agent config file contents (verify intent — authoring guides use this shape too)hermes_config_modzImodification language aimed at Hermes configuration files (verify intent)hermes_config_mod_shellzLshell write (redirect/sed -i/tee/cp/mv) targeting Hermes configuration filesother_agent_config_modz*modifies other agents' configuration filesother_agent_config_mod_shellzSshell write (redirect/sed -i/tee/cp/mv) targeting other agents' configuration filesz(\b(?:include|output|print|send|share)\s+zf(?:conversation|chat\s+history|previous\s+messages)\b|\b(?:print|send|share|output|upload|transmit)\s+z(?:(?:\w+\s+){0,2}?z3(?:\w+\s+){0,2}?context\b|(?:\w+\s+){0,3}?context\b|) context_exfilz4instructs agent to output/share conversation history.py#.sh.bash.rb.pl.r.jl.yaml.yml.toml.conf.cfg.ini.js//.ts.phpz^\s*(?:(?:const|let|var|export)\s+)?[\w.\-]*(?:deny|black|block|skip|exclu|ignor|forbid|refus|reject|never|unsafe|sensitive|secret_?file|redact)[\w.\-]*\s*(?::[^=]*?)?(?:=|:\s*(?:$|[\[({]))a\b(?:cat|less|more|head|tail|cp|mv|rm|scp|rsync|curl|wget|tee|chmod|chown|ssh|sudo|install|source|eval|exec|system|popen|run|check_output|copyfile|copy2|sendfile)\b|\.(?:read|write|open|unlink|copy|append)\w*\s*\(|\bopen\s*\(|readFileSync|writeFileSync|appendFileSync|>>z'[^'\n]*'|"[^"\n]*\"c0V^8dQhR\R\/#rlinesrC)r=)r!s"r#r$r$0s  T d r&c pa.^^R3wrr4\V4FwrVV^8:d V'gTpVPV4\PRV4o\ ^V\ V3RlR44,\ V3RlR44, 4pVP 4PR4pK V#)aB0-indexed line that opened each line's statement (an unclosed bracket or trailing backslash continues it), so a match on a continuation line of a multi-line regex can be traced to the assignment target above it. Quoted spans are blanked before counting brackets; a miscount costs a missed demotion, never a missed finding.Fr3c3F<"TFpSPV4xK R#5iNcount.0cbares& r# $_statement_owners..:s"@%Q4::a==%!z([{c3F<"TFpSPV4xK R#5irrrs& r#rr:sFd^cYZtzzRS}}^crz)]}\) enumerateappend_QUOTED_SPAN_REsubmaxsumrstripendswith)rownersdepthowner continuedirrs& @r#_statement_ownersr0s')!Qo#F5U# A:iE e""2t,Aus"@%"@@@3Fd^cFdCddeKKM**40 $ Mr&cV^8dQhR\R\R\R\R\R\R\\\3,/#)rpidrrr owner_linesuffixrC)rtuple)r!s"r#r$r$?sI ! !c !S !s !RU !cf !), !16sCx !r&cV\9dW3#VP4P\P VR44'dRV R23#\ P V4'd#\PV4'gRV R23#W3#)zc``(severity, description)`` for a path-token match, lowered when the line cannot act where it sits.lowz (in a comment; informational)rQz3 (in a denylist literal; confirm before installing)r') _PATH_REFERENCE_PATTERN_IDSlstrip startswith_COMMENT_PREFIXget_DENYLIST_OWNER_REr_ACTION_ON_LINE_REsearch)rrrrrrs&&&&&&r#_demote_inert_path_referencer?s --$$ {{} 3 3FB ?@@ %CDDD ++4F4M4Md4S4S+&YZZZ   r&iu​zzero-width spaceu‌zzero-width non-joineru‍zzero-width joineru⁠z word joineru⁢zinvisible timesu⁣zinvisible separatoru⁤zinvisible plusuzBOM/zero-width no-break spaceu‪z LTR embeddingu‫z RTL embeddingu‬zpop directionalu‭z LTR overrideu‮z RTL overrideu⁦z LTR isolateu⁧z RTL isolateu⁨zfirst strong isolateu⁩zpop directional isolatec0V^8dQhR\R\/#)rcharrCrD)r!s"r#r$r$bsAASASAr&cH\PVR\V4R 24#)U+04X)_INVISIBLE_CHAR_NAMESrord)rs&r#_unicode_char_namerbs" $ $TRD #+? @@r&c0V^8dQhR\R\/#r)r=set)r!s"r#r$r$fs  D S r&c6\4pRp\V^R7Fvwr4TRUu.uFqTPV4NK pppV\V4^,^8H,pV'gV'g\ V4'gKeVP V4Kx V#uupi)a1-indexed lines inside or on the boundary of triple-quoted strings (opening, interior, closing, and one-line docstrings), so ``os.environ`` in prose is not scored. Heuristic: a triple quote inside a string literal is miscounted, but the common false-positive shapes are covered.Fstart)z"""z''')rrrranyadd)r doc_linesinsiderrmarkerwas_incountss& r#_compute_docstring_linesrfsUI FU!,>!R>**V"4>!R#f+/Q&& Vs6{{ MM!  -  "SsBc0V^8dQhR\R\/#)rrrCrD)r!s"r#r$r$ts33r&c\V4p^pVPRV4;pR 8wd^pRpV^,pV\V48d{W,pV'dRpM\VR8XdRpMRVR8Xd V^, pMAVR8Xd;V^,pV^8Xd+RWc, ^, ,W^,V%V^,pKV^, pKRPV4#) a)Blank balanced inline-link destinations while preserving line offsets. A relative Markdown destination describes documentation structure; it does not cause filesystem access. Nested parentheses and escaped characters are handled so a later, non-link traversal on the same line remains scannable. z](FrT(rj r3)r=findlenjoin)rmasked search_fromrrescapedcursorrs& r# _mask_markdown_link_destinationsrts$ZFKIIdK0 05R 7s4y `{3,}|~{3,})(?P.*)$z-^(?: {0,3}(?:>|(?:[-*+]|\d{1,9}[.)]) {1,4}))+c\V^8dQhR\\,R\\,/#r)r=r)r!s"r#r$r$s"ctCyr&cb.pRpVEF#p\P\PRV44pVeeV'dZVR,^,V^,8Xd>\ VR,4V^,8d VR,P 4'gRpRpMjV'dFVR,^,R8XdRVR,9g#VR,^,\ VR,43pVRJ;'gVP R4pTPV'dTM \V44EK& V#)aMask link destinations only in Markdown prose. Inside a fenced or indented code block a ``[x](../..)`` is an argument to whatever command surrounds it, not a hyperlink, so those lines scan verbatim. Fence state is ``(marker_char, opener_length)`` rather than a bool so a mismatched fence line cannot drop the scanner back into prose mode; an unclosed fence stays code to EOF (fail-safe).Nr3rinfoT`) z ) _FENCE_LINEr_CONTAINER_PREFIXrrstriprrr)routfencerrcodes& r#_mask_prose_link_destinationsrs C E!!"3"7"7D"AB  %/!,a8Sx=QUZ[\U]=]!&M//11DeHoa0C7C5=.sB_T !!_s Ninvisible_unicoderQ injectionrr (rjzinvisible unicode character z! (possible text hiding/injection))namerlowerSCANNABLE_EXTENSIONS read_textsplitUnicodeDecodeErrorOSErrorrrr_COMPILED_THREAT_PATTERNSr_PATH_TRAVERSAL_PATTERN_IDSrrrrrrnextINVISIBLE_CHARSrr)rrrr9docstring_linestraversal_linesrrpatternrrrrr scan_linetext line_severityline_descriptionrrrs&& @r# scan_filers))9>>H';; R\@\ ##[#9??EH.u5O>G>N>N>T>T>VZ_>_3E:ejO%%++-/@/GF9R5h+ a0GAt259T2TA.Z^I'GNN9,E,Ezz|2N;e1q5M6JF3T/ /]HPQ03D S0@d4jSXFXZj!lm 1:SU!,4B_BDI ID V%d+D OOG$7h&(T3r$q$A&B4&Hi$jl m- O+  ( s!HH54H5c0V^8dQhR\R\/#)rfrC)r)r!s"r#r$r$s  w 7 r&cVPR9daVP\9dLVPP 4P R4'dRVP R2uVnVnV#)rOrmediumz) (not executed on install; informational))rOrQ)rr _DOC_NOTE_IDSrrrr)rs&r#_community_notersVzz)) LLM )afflln.E.Ee.L.L$,?h.i! AM Hr&c<V^8dQhR\R\R\/#)r skill_pathr6rC)r rr1)r!s"r#r$r$s&NN4NNzNr&cVP\V4r2.pVP4'd\V4pVP \ WR74VP R4F_pVP4'gKV!\VPV44;p4'dKEVP \Wg44Ka M:VP4'd%VP \WP44VR8XdVUu.uFp\V4NK pp\V4p\W!W8V\P!\ 4P#4\%W!W8V44#uupi)a@Structural checks + pattern scan of every text file in a skill dir (or a single file). A gitignore-style `.skillignore` / `.clawhubignore` excludes dev/docs artifacts from BOTH passes; the ignore file itself is always excluded and `SKILL.md` can never be un-ignored. *source* (e.g. "openai/skills") sets the trust level.)ignore*r)r_resolve_trust_levelis_dir_load_skill_ignoreextend_check_structurerglobis_filer relative_torr_determine_verdictr1rnowr isoformat_build_summary) rr6rtrustr9rrrelr8s && r# scan_skillrs//#7#?% H#J/(CD!!#&Ayy{{6Q]]:5N1O*O##P#P ! 12'      *oo>? 0891OA&9 *G dEHhll3>O>Y>Y>[$T58L NN:sE0c0V^8dQhR\R\/#rrrCr r)r!s"r#r$r$sr&caSP4'g3\P!SP44P 4#\P!4p\ V3RlSP R444FKwr#VPVPR4R,4VPVP44KM VP 4#)u^Canonical SHA-256 over (POSIX relative path, file bytes) ORDERED by the rel-path STRING — Path sorting is case-insensitive on Windows and diverged from ``skills_hub.bundle_content_hash`` (every installed skill then reported ``update_available`` forever). String order keeps both sides byte-symmetric. Ordering by ``sorted(rglob(...))`` diverged from the bundle side on Windows: Path comparison is case-insensitive there (normcase), while ``bundle_content_hash`` sorts plain strings — the same skill hashed to different digests and every installed skill reported ``update_available`` forever (#62310). c3<"TF=qP4'gKVPS4P4V3xK? R#5ir)rras_posix)rprs& r#r"_content_digest..s6qLaqenenepB!-- 3<<>BLas A)Ar utf-8) r hashlibsha256 read_bytes hexdigestsortedrupdateencode)rhrrsf r#_content_digestr+s     ~~j3356@@BBAqJL\L\]`Laqq G$w./  r ;;=r&c0V^8dQhR\R\/#rr)r!s"r#r$r$ s88T8c8r&c,R\V4R, 2#)uShort integrity hash (paths mixed in, so swapping two files' contents changes it). MUST stay symmetric with ``tools.skills_hub_install.bundle_content_hash`` — change both at once.sha256:NN)r+)rs&r# content_hashr1 s_Z056 77r& source_url cache_dirc V^8dQhR\R\R\R\R,R\\\3,/#)rrr6r2r3NrC)r rrr1r>)r!s"r#r$r$s@$RU!%8=j$>N8Or&ca \V4pT;'gVPR, p\P!V RV 2P 44P 4R,pWT RV R2, pRRV 2R\ R VR V/pR o \\\P4;_uu_4\P!VPR R 74o R R R 4\S \4'd\;QJd-V 3RlVP!44F 'dK RM" RM!V 3RlVP!444'ds\#VP$TS R,S R,S P'R.4U u.uFp \)R/V BNK up S R,S P'RR44p /S CRR/Cp M\+WR7p V P,U u.uFp \/V 4NK p p /VCRV P0RV P2RT R\5V U u0uF qR,kK up 4RV P6RV P8RR/Cp \\4;_uu_4VP;RRR7VP=\P>!V ^R7R,RR 7R R R 4Wn W3# +'giEL;iuup iuup iuup i +'giL<;i) zScan plus attestation dict; the cache (keyed by content digest + source identity) only serves exact current content under the current scanner version.z .scan-cacher/-.json bundle_hashr.scanner_versionr6r2Nrrc3P<"TFwrSPV4V8HxK R#5ir)r)rkvcacheds& r#r$scan_skill_cached.. s"'XGWtq 1 (:GWs#&FTr7r8r9r:r;r3fresh)r6rulesr)parentsexist_ok)indentrr!r')!r+parentr#r$r)r&SCANNER_VERSIONrrjsonJSONDecodeErrorloadsr isinstancer>allitemsr1rrrrr9rr8r7r'r:r;mkdir write_textdumpsr<)rr6r2r3digest cache_rootsource_identity cache_fileexpecteditemresult provenancer9r>s&&$$ @r#scan_skill_cachedrXs|Z (F??j//-?Jnnxr*%>%E%E%GHRRTUXYO/):%@@J13DoW_agj*H F '4// 0 0J00+0FG 1&$CC'Xx~~GW'XCCC'Xx~~GW'X$X$XJOOVVM5JFS\L]9?JPR9ST9SW_t_9STV\]iVj"JJy"570// J6-3__=_TF4L_=@@)V^^]FL^L^`jltvh&OhdL'9'9h&OPR^`f`q`q$@ g     TD  9  ! !$**Z"BT"IT[ ! \(  # 1 0 0U >&O  s+/'J9K KK$AK9 K  K, c^V^8dQhR\R\R\\\3,/#)rrVforcerC)r1boolrr)r!s"r#r$r$2s0 } } }D }U4QT9EU }r&cv\PVP\R,4\PVP^4,p\ VP 4pVPR8H;'dVPR9pVR8Xd RRVP RVP R23#V'dV'gRRVP R V R 23#VR 8Xd#R R VP RVP RV R 23#RVP RVP RV R2pRYT'd R,3#R,3#)z``(allowed, reason)`` from verdict + trust; *force* overrides every block except a dangerous verdict on community/trusted sources. ``allowed`` is None when policy says "ask".rrallowTz Allowed (z source, z verdict)zForce-installed despite z verdict (z findings)askNzRequires confirmation (z source + z verdict, z Blocked (z findings). Fz.--force does not override a dangerous verdict.zUse --force to override.)rr)INSTALL_POLICYrr7 VERDICT_INDEXr8rr9)rVrZdecisionn hard_blockblockeds&& r#should_allow_installre2sA!!&"4"4n[6QRS`SdSdekesesuvSwxH FOOA;.aa63E3EIa3aJ7y!3!3 4Ifnn=MYWWW Z//?z!JWWW5.v/A/A.B*V^^L\\fghfiisttt&,,-Z7GzRSQTT`aG 'Q[M| ||a{| ||r&c0V^8dQhR\R\/#)rrVrC)r1r)r!s"r#r$r$Bs C Cz Cc Cr&c aRVP RVP RVP RVPP 4 2.pVP 'dR^R^R^R^/o\ VP V3R lR 7FpVPR VPP 4P^4 R VPP^4 R VP R VP 2P^4 RVPR, R2 4K VPR4\V4wr4VRJdRMVfRMRpRPVRV RV 2.,4#)uQCompact multi-line report for CLI/chat display; findings sorted critical → low.zScan: r/z ) Verdict: rOrQrrc<<SPVP^4#))rr)rorders&r#$format_scan_report..GsuyyQ7Or&)keyz r:z ":N<N"r3TALLOWEDzNEEDS CONFIRMATIONBLOCKEDrz Decision:  — )r5r6r7r8upperr9r'rrljustrrrrrer)rVrrallowedreasonstatusrks& @r#format_scan_reportrzBsOf''(6==/6;M;M:Nl[a[i[i[o[o[qZr s tE Q8QqA-OPA LL2ajj..066q9:!AJJ bool* excludes paths from every count and finding.c B<SP\WW#^WE44R#)N)rr)rsevcatrrdescr9s&&&&&&r#r_check_structure..addUs#AuCDr&r symlink_escaperO traversalz symlink -> z*symlink points outside the skill directorybroken_symlinkrzbroken symlinkzbroken or circular symlinkioversized_file structuralKBzfile is z KB (limit: zKB) binary_filezbinary: zbinary/executable file (z) should not be in a skillunexpected_executablezexecutable bit setzBfile has executable permission but is not a recognized script typetoo_many_filesz (directory)z filesz skill has z files (limit: rjoversized_skillrzKB totalz skill is zKB total (limit: )rrrr is_symlinkresolveis_relative_torstatst_sizeMAX_SINGLE_FILE_KBrrSUSPICIOUS_BINARY_EXTENSIONS_SCRIPT_EXTENSIONSst_modeMAX_FILE_COUNTMAX_TOTAL_SIZE_KB) r|rr file_count total_sizerrresolvedstsizeextr9s && @r#rrPsbHEJ __S !!-- *+ q||~~63E&QT++ a <<>> r99;..y/@/@/BCC(*k3+V^U_H`DF  B zz)t* $t+ +  (L#$,r?R44<. 4F3GsK M88>># #C(D D  z<>N*3%/IJ L ( (RZZ%-?-? '<FZT V5"8N" h m |SYEZ ON3C1 E G%,, ulMjTXFXEYYaCb d*++<=N bool`` from `.skillignore` / `.clawhubignore`. gitignore basics: blank lines and ``#`` comments skipped; trailing ``/`` = directory (it and everything under it); ``*``/``?`` globs via fnmatch on the full path and each segment; leading ``/`` anchors to the root. Ignore files always excluded; ``SKILL.md`` never.c36<"TFpSV, xK R#5irr')rrr|s& r#r%_load_skill_ignore..sD,CDy4,Csc3l"TF*pV'gK VPR4'dK&VxK, R#5i)rmNr)rss& r#rrs. @+ja#$!"-.\\#->!"+js 44 4rrNc0V^8dQhR\R\/#)rrrC)rr[)r!s"r#r$(_load_skill_ignore..__annotate__sCDr&c<a\V4P4pVPR4pVR,pVR8XdR#V\9dR#SEF8pVP R4pVP R4oS'gK0VP SR,4pVP R4'dBVS8Xg4V'g,V'g)RS,R,RV,R,9dR#KK\P!VS4'g|V'dK\P!VS4'gUV'gMRS9gK\;QJdV3RlV4F 'gK RM RM!V3RlV44'gEK8R# R#)rhrFTc3R<"TFp\P!VS4xK R#5ir)fnmatch)rsegrs& r#r5_load_skill_ignore..ignore..s(QDSa)@)@Ds$'r) r rr_SKILL_IGNORE_FILENAMESrrrrr) r rel_posixsegsbasepatanchoredbelowrpatternss & @r#r"_load_skill_ignore..ignoresI&&( s#Bx :  * *C~~c*H #A((S1E||C  >U8q3TWZcTcfiTi@jAk8A..xxW__UY[\E]E]afqLSS(QD(QSSS(QD(Q%Q%Qr&) rrrrrr maprrr splitlines)r|igrrsf @r#r r s HD,CD (' 2 2zz|| @3syy",,P[,:\:g:g:i+j @@3 2E . M93 2 2s A%B00 C c0V^8dQhR\R\/#)rr6rCrD)r!s"r#r$r$siiiir&caaS\\V3Rl\4R44RoSR8XdR#SR8XdR#\;QJd#V3Rl\4F 'gK RM R M!V3Rl\44'dR #R #) uSource id -> trust level. "official" is provenance, not a user-controlled GitHub id like "official/"; trusted repos match exactly or as a skill path inside the repo — never a sibling sharing the prefix.c3Z<"TF pSPV4'gKVxK" R#5irr)rrr6s& r#r'_resolve_trust_level..s#U&<@Q@QRS@T11& NVIDIA/skills openai/skillsanthropics/skillshuggingface/skills)r]r]r])r]r]block)r]rr)r]r]r^)zvcurl\s+(?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)S?\benv_exfil_curlrOrPz6curl command interpolating secret environment variable)zvwget\s+(?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)S?\benv_exfil_wgetrOrPz6wget command interpolating secret environment variable)znfetch\s*\((?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD)S?\benv_exfil_fetchrOrPz6fetch() call interpolating secret environment variable)zwhttpx?\.(get|post|put|patch)\s*\((?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*(KEY|TOKEN|SECRET|PASSWORD)env_exfil_httpxrOrPz&HTTP library call with secret variable)zyrequests\.(get|post|put|patch)\s*\((?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*(KEY|TOKEN|SECRET|PASSWORD)env_exfil_requestsrOrPz*requests library call with secret variable)zbase64[^\n]*env encoded_exfilrQrPz0base64 encoding combined with environment access)z\$HOME/\.ssh|\~/\.sshssh_dir_accessrQrPzreferences user SSH directory)z\$HOME/\.aws|\~/\.awsaws_dir_accessrQrPz)references user AWS credentials directory)z\$HOME/\.gnupg|\~/\.gnupggpg_dir_accessrQrPzreferences user GPG keyring)z\$HOME/\.kube|\~/\.kubekube_dir_accessrQrPz&references Kubernetes config directory)z\$HOME/\.docker|\~/\.dockerdocker_dir_accessrQrPz5references Docker config (may contain registry creds))z'\$HOME/\.hermes/\.env|\~/\.hermes/\.envhermes_env_accessrOrPz'directly references Hermes secrets file)zFcat\s+(?!>)[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)read_secrets_filerOrPzreads known secrets file)z3printenv|(?\s*/tmp/[^\s]*\s*&&\s*(curl|wget|nc|python) tmp_stagingrOrPzwrites to /tmp then exfiltrates)z!\[.*\]\(https?://[^\)]*\$\{?md_image_exfilrQrPzBmarkdown image URL with variable interpolation (image-based exfil))z\[.*\]\(https?://[^\)]*\$\{? md_link_exfilrQrPz)markdown link with variable interpolation)z=ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+instructionsprompt_injection_ignorerOrz.prompt injection: ignore previous instructions)zyou\s+are\s+(?:\w+\s+)*now\s+ role_hijackrQrz%attempts to override the agent's role)zdo\s+not\s+(?:\w+\s+)*tell\s+(?:\w+\s+)*the\s+user(?!\s+to\s+["\'\u201c\u2018])(?!.*\b(?:unless|except|until|confirm|diagnos\w*|verify|check)\b)deception_hiderQrz-instructs agent to hide information from user)z0system\s+(?:\w+\s+)*prompt\s+(?:\w+\s+)*overridesys_prompt_overriderOrz&attempts to override the system prompt)z+pretend\s+(?:\w+\s+)*(you\s+are|to\s+be)\s+ role_pretendrQrz6attempts to make the agent assume a different identity)zRdisregard\s+(?:\w+\s+)*(your|all|any)\s+(?:\w+\s+)*(instructions|rules|guidelines)disregard_rulesrOrz&instructs agent to disregard its rules)z-output\s+(?:\w+\s+)*(system|initial)\s+promptleak_system_promptrQrz%attempts to extract the system prompt)z.(when|if)\s+no\s*one\s+is\s+(watching|looking)conditional_deceptionrQrz=conditional instruction to behave differently when unobserved)zwact\s+as\s+(if|though)\s+(?:\w+\s+)*you\s+(?:\w+\s+)*(have\s+no|don\'t\s+have)\s+(?:\w+\s+)*(restrictions|limits|rules)bypass_restrictionsrOrz+instructs agent to act without restrictions)z5translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)translate_executerOrz(translate-then-execute evasion technique)ahhtml_comment_injectionrQrz$hidden instructions in HTML comments)z5<\s*div\s+style\s*=\s*["\'][\s\S]*?display\s*:\s*none hidden_divrQrz(hidden HTML div (invisible instructions))a rm\s+-rf\s+((?:[^\s;&|<>#][^\s;&|<>]*\s+)+?)?/(?(1)(?!/(?:\s|$)))(?:(?!(?:tmp|var/tmp|dev/shm|run|var/lib/apt/lists|var/cache/(?:apt|apk|yum|dnf))(?:\b|/))|(?:tmp|var/tmp|dev/shm|run|var/lib/apt/lists|var/cache/(?:apt|apk|yum|dnf))/(?:[^/\s]*/)*\.\.(?=/|[\s;&|]|$))destructive_root_rmrO destructivezrecursive delete from root)zg(?\s*/etc/system_overwriterOrz$overwrites system configuration file)z\bmkfs\bformat_filesystemrOrzformats a filesystem)z\bdd\s+.*if=.*of=/dev/disk_overwriterOrzraw disk write operation)zshutil\.rmtree\s*\(\s*[\"\'/] python_rmtreerQrz/Python rmtree on absolute or root-relative path)ztruncate\s+-s\s*0\s+/truncate_systemrOrz#truncates system file to zero bytes)z \bcrontab\bpersistence_cronrrTzmodifies cron jobs)z:\.(bashrc|zshrc|bash_profile|bash_login|zprofile|zlogin)\b shell_rc_modrrTreferences shell startup file)z(?you\s+have\s+been\s+(?:\w+\s+)*(updated|upgraded|patched)\s+to fake_updaterQrz3fake update/patch announcement (social engineering))zYnew\s+(?:\w+\s+)*policy|updated\s+(?:\w+\s+)*guidelines|revised\s+(?:\w+\s+)*instructions fake_policyrrz8claims new policy/guidelines (may be social engineering))z6(send|post|upload|transmit)\s+.*\s+(to|at)\s+https?:// send_to_urlrQrPz%instructs agent to send data to a URL>rrrrrrr)rm;)r{rm>rrrsrzrrqrlrprnr|rx.cssryr}.tex.txt.xmlrurorw.htmlr8rvrt> .so.app.bin.com.dat.deb.dll.dmg.exe.msi.rpm.dylib>rqrlrprnro)r3)r)Fr)z .skillignorez.clawhubignore)z skills-sh/z skills.sh/z skils-sh/z skils.sh/)W__doc__rerr#rG contextlibr dataclassesrrrrrrpathlibr typingr r rFrr_r`rr1rJ_AGENT_CONFIG_FILES_HERMES_CONFIG_FILES_OTHER_AGENT_CONFIG_FILESrGrKrN _NO_TRANSFER _SHORT_FILLER _NOT_DELEGATE _CTX_SCOPE _CTX_DEST _CTX_DATIVE_SHELL_NAMES_RE _SUDO_PREFIX _CRED_FILE_CRED_FILE_LITERAL_PY_CRED_FILE_ARGTHREAT_PATTERNScompile IGNORECASEr frozensetrrrrrrrrrrrrrrrrrrrrrrrrrrrr+r1rXrerzrrr rr rr)rrests00r#rps f  00,,%^ 3 331 Iq+q9    88 8NN<G M9mK $ YI  ' 7 0* D '36GG8;MMPYY| m |m|n|^|e|"v#|$j%|&v'|(l)|*v+|,k-|0a1|6R7|:57IIZ9ce;|N**`a-.0jkZ9_aO|`Pa|lzm|pHq|t~u|xry||B}|\t]|hSi|nuo|r|s|vkw|zt{|B]C|H_I|LdM|P[Q|TYU|XtY|\d]|`_a|h\i|zT{|PUQ|\q]|`ca|bjc|dZe|fig|hBi|jtk|nXo|zO{|~O|BdC|DQE|FZG|JcK|LXM|PrQ|RwS|ZQ[|^X_|b@c|dpe|f o 23:y2_ag|jsk|nzo|pgq|t_u|H[I|TaU|XbY|bJc|h o..EFz=2[]i|lVm|ppq|twu|vpw|zo{|~f|@lA|B^C|FiG|LPM|PoQ|RgS|T}U|V~W|XzY|dPe|lsm|nfo|pvq|rzs|tgu|xBy|zz{|F !.?@BSU_aor^_G|H $L>/1BC N4`bI|L !f57I:WehJKM|PzQ|T^U|X|Y|Zl[|^U_|bec|dfe|jAk||W}|F lG |L bM |P xQ |T hU |j )*]5PQk |n ()z=;YZo |r -.fm6STs |v Dw |z *+&-1|~{ |~ )* M?@  NN*$8 XZ/3> } } C**\=#LPiX vO ps*R,