domains / families / security / aeon-skill-security-scan

aeon-skill-security-scan

separate

Audit installed Bankr skills before you run them — scan SKILL.md and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and 2026-era obfuscation (zero-width Unicode, bidi override, base64-decode pipes, webhook SSRF hosts). Designed to integrate with Bankr Safety Scores. Silent on no-op runs; surfaces only NEW or RESOLVED findings vs prior scans. Triggers: "audit this skill", "is this skill safe to install", "security scan my skills", "check skill X for injection".

When to use

• `<skills-dir>/*/SKILL.md` — primary.
• `<skills-dir>/*/scripts/*.sh` and `*.py` — companion scripts.
• `<skills-dir>/*/references/*` — documents loaded at runtime.

When not to use

• auto-deleting baseline suppression
• editing the pattern library
• notifying on a pure no-op week
• writing output on no-op runs

Skill page

Source