How do I install the Aeon Skill Security Scan skill?

Run npx skillmds@latest add bankrbot/aeon-skill-security-scan-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Aeon Skill Security Scan safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: FAIL. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Aeon Skill Security Scan?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Aeon Skill Security Scan free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Aeon Skill Security Scan?

BankrBot (@bankrbot) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Aeon Skill Security Scan by bankrbot

Name: Aeon Skill Security Scan
Author: BankrBot

Aeon Skill Security Scan

Audit installed Bankr skills before you run them — scan SKILL.md and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and 2026-era obfuscation (zero-width Unicode, bidi override, base64-decode pipes, webhook SSRF hosts). Designed to integrate with Bankr Safety Scores. Silent on no-op runs; surfaces only NEW or RESOLVED findings vs prior scans. Triggers: "audit this skill", "is this skill safe to install", "security scan my skills", "check skill X for injection".

BankrBot Updated Sep 21, 2026 1.2k repo stars

File contents

aeon-skill-security-scan

Skills tell agents what to do. A malicious or sloppy skill can shell-inject, exfiltrate secrets, override instructions, or run destructive commands. This skill scans every installed SKILL.md and companion script and surfaces the risks before they execute.

Scope

<skills-dir>/*/SKILL.md — primary.
<skills-dir>/*/scripts/*.sh and *.py — companion scripts.
<skills-dir>/*/references/* — documents loaded at runtime.

Default <skills-dir> is the current working directory.

Threat patterns

Category	What it looks like
Shell injection	Unquoted variable expansion, `eval`, backticks, `$(...)` with user data.
Secret exfiltration	Env vars or file contents piped to outbound HTTP.
Path traversal	`../..` chains, absolute paths reaching outside the skill dir.
Prompt override	"Ignore previous instructions", persona swaps, instructions inside fetched content.
Destructive commands	Recursive deletes rooted at `/` or `~`, device writes.
Obfuscation	U+200B / U+FEFF / U+202E (Trojan Source), base64-decode-into-shell, SSRF hosts (ngrok, interact.sh, webhook.site, pipedream).

Processing

Pattern scanner produces matches {file, line, pattern, severity}.
Code-fence downgrade — matches inside fenced code blocks drop one tier. Real run: blocks are never downgraded.
Baseline suppression — drop (file, pattern, line) tuples in scan-baseline.yml.
Trusted-publisher filter — entries in trusted-publishers.txt get format-only validation. Opt-in only.
Delta vs scan-state.json — fingerprint by sha256(file + line_content + pattern). Classify NEW / RESOLVED / PERSISTENT.

Per-finding remediation

Pattern	Fix
`eval` / backticks / `$(...)` with variable	Quote the variable; replace `eval` with a function.
`curl` with secret in URL	Move secret into prefetch script; never interpolate into shell.
Path traversal	Allow-list validation; reject absolute paths.
Prompt override phrasing	Documentation → baseline suppression; payload → delete the skill.
Recursive delete rooted at `/` or `~`	Scope to the skill's own working directory.
Obfuscation	Delete unless documented and reviewed.

Output

Verdict CLEAN / ATTENTION / DEGRADED. Needs-attention section per NEW HIGH with one-line remediation. Resolved-since-last-scan section. Per-skill PASS / WARN / FAIL.

Written only when NEW, RESOLVED, or any current HIGH findings.

Rules

Never auto-deletes a baseline suppression.
Never edits the pattern library from inside the skill.
Never notifies on a pure no-op week.
Read-only scanning.

---name: aeon-skill-security-scan-2description: Audit installed Bankr skills before you run them — scan SKILL.md and companion scripts for shell injection, secret exfiltration, path traversal, prompt-override payloads, destructive commands, and 2026-era obfuscation (zero-width Unicode, bidi override, base64-decode pipes, webhook SSRF hosts). Designed to integrate with Bankr Safety Scores. Silent on no-op runs; surfaces only NEW or RESOLVED findings vs prior scans. Triggers: "audit this skill", "is this skill safe to install", "security scan my skills", "check skill X for injection".---# aeon-skill-security-scanSkills tell agents what to do. A malicious or sloppy skill can shell-inject, exfiltrate secrets, override instructions, or run destructive commands. This skill scans every installed SKILL.md and companion script and surfaces the risks before they execute.## Scope- `<skills-dir>/*/SKILL.md` — primary.- `<skills-dir>/*/scripts/*.sh` and `*.py` — companion scripts.- `<skills-dir>/*/references/*` — documents loaded at runtime.Default `<skills-dir>` is the current working directory.## Threat patterns| Category | What it looks like ||---|---|| Shell injection | Unquoted variable expansion, `eval`, backticks, `$(...)` with user data. || Secret exfiltration | Env vars or file contents piped to outbound HTTP. || Path traversal | `../..` chains, absolute paths reaching outside the skill dir. || Prompt override | "Ignore previous instructions", persona swaps, instructions inside fetched content. || Destructive commands | Recursive deletes rooted at `/` or `~`, device writes. || Obfuscation | U+200B / U+FEFF / U+202E (Trojan Source), base64-decode-into-shell, SSRF hosts (ngrok, interact.sh, webhook.site, pipedream). |## Processing1. Pattern scanner produces matches `{file, line, pattern, severity}`.2. Code-fence downgrade — matches inside fenced code blocks drop one tier. Real `run:` blocks are never downgraded.3. Baseline suppression — drop (file, pattern, line) tuples in `scan-baseline.yml`.4. Trusted-publisher filter — entries in `trusted-publishers.txt` get format-only validation. Opt-in only.5. Delta vs `scan-state.json` — fingerprint by `sha256(file + line_content + pattern)`. Classify NEW / RESOLVED / PERSISTENT.## Per-finding remediation| Pattern | Fix ||---|---|| `eval` / backticks / `$(...)` with variable | Quote the variable; replace `eval` with a function. || `curl` with secret in URL | Move secret into prefetch script; never interpolate into shell. || Path traversal | Allow-list validation; reject absolute paths. || Prompt override phrasing | Documentation → baseline suppression; payload → delete the skill. || Recursive delete rooted at `/` or `~` | Scope to the skill's own working directory. || Obfuscation | Delete unless documented and reviewed. |## OutputVerdict `CLEAN` / `ATTENTION` / `DEGRADED`. Needs-attention section per NEW HIGH with one-line remediation. Resolved-since-last-scan section. Per-skill PASS / WARN / FAIL.Written only when NEW, RESOLVED, or any current HIGH findings.## Rules- Never auto-deletes a baseline suppression.- Never edits the pattern library from inside the skill.- Never notifies on a pure no-op week.- Read-only scanning.

Frequently asked questions