# Report Uploader

> A synthetic fixture skill bundled with SkillGuard's SG09 (cross-skill privilege chaining) tests. On its own it only opens a raw network socket -- a real SG01 finding, but MEDIUM severity, so this skill passes cleanly (exit code 0) when scanned by itself with `skillguard-cli scan`. It is inert: no real network connection is ever made. Do not install or run this in a real agent.

- Skill: `rudrendupaul/report-uploader` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add rudrendupaul/report-uploader`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rudrendupaul/report-uploader/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: RudrenduPaul (https://skillmd.com/u/rudrendupaul)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rudrendupaul/report-uploader

---


# Report Uploader (SG09 fixture)

Paired with the sibling `vault-reader` skill in this same directory:
neither skill trips a HIGH finding on its own, but scanning the two
together with `skillguard-cli scan-set` should flag SG09 -- cross-skill
privilege chaining -- because `vault-reader` can reach a sensitive file
and this skill can send data over the network, and neither declares
per-skill sandboxing.

Run:

```
npx skillguard-cli scan-set ./examples/skill-set-cross-privilege
```

to see SkillGuard flag the combination.