# False Positive Test Skill > A skill containing patterns that should NOT trigger false positives - Skill: `ryo-ebata/false-positive-test-skill` (Agent Skill) - Install (CLI): `npx skillmds@latest add ryo-ebata/false-positive-test-skill` - Raw SKILL.md: https://api.skillmd.com/api/skills/ryo-ebata/false-positive-test-skill/raw - Safety review: pending (external: skill-scanner FAIL, skillspector FAIL) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: ryo-ebata (https://skillmd.com/u/ryo-ebata) - Updated: 2026-09-09 - Page: https://skillmd.com/skills/ryo-ebata/false-positive-test-skill --- # False Positive Test Skill This skill demonstrates patterns that look suspicious but are actually benign. The scanner should NOT flag these patterns. ## EX (Exfiltration) - Safe Patterns ### EX-001: Localhost requests with environment variables (excluded) ```bash # These should be excluded because they target localhost curl http://localhost:3000/api -d "key=$API_KEY" curl http://127.0.0.1:8080/webhook -d "$DATA" wget http://localhost:5000?token=$TOKEN curl http://[::1]:3000/metrics -H "Authorization: $AUTH" # External requests without sensitive env vars are safe curl https://api.github.com/repos wget https://example.com/file.zip ``` ### EX-002: Base64 encoding for display purposes (no network) ```bash # Just encoding, no network transmission base64 logo.png > logo.b64 cat file.txt | base64 > encoded.txt # Localhost is excluded cat data.txt | base64 | curl http://localhost:3000 -d @- ``` ### EX-005: Netcat in listening mode (excluded) ```bash # Listening mode is for receiving, not exfiltrating nc -l 8080 nc -l -p 3000 netcat -l 4444 # Localhost connections are safe nc localhost 3000 nc 127.0.0.1 8080 ``` ## PE (Privilege Escalation) - Safe Patterns ### PE-001: Words containing "sudo" but not sudo command ```bash # These are not sudo commands pseudocode --version visudo --check /etc/sudoers.d/test sudoedit myfile.txt echo "pseudorandom numbers" ``` ### PE-002: Safe rm commands ```bash # Deleting specific paths is safe rm -rf /tmp/build-cache rm -rf ./node_modules rm -rf /var/log/old-logs/* rm file.txt rm -rf /home/user/project/dist # Note: rm -rf / would be dangerous but these are not ``` ### PE-003: Safe chmod permissions ```bash # Standard secure permissions chmod 755 /var/www/html chmod 644 config.json chmod 600 ~/.ssh/id_rsa chmod 700 ~/.ssh chmod 750 /opt/app chmod +x script.sh chmod u+x build.sh ``` ### PE-004: Safe /etc file access ```bash # These files are safe to read cat /etc/hosts cat /etc/resolv.conf cat /etc/hostname cat /etc/os-release cat /etc/timezone ``` ### PE-005: SSH commands without file access ```bash # SSH client usage is safe ssh user@server.com ssh -i /path/to/key user@host ssh-keygen -t ed25519 ssh-add ~/.ssh/id_rsa ssh-copy-id user@server sshpass -p $PASS ssh user@host ``` ## PS (Persistence) - Safe Patterns ### PS-001: Crontab list only (excluded) ```bash # Listing crontab is safe crontab -l crontab -l -u root ``` ### PS-003: Reading shell profiles (not modifying) ```bash # Reading profiles is safe cat ~/.bashrc cat ~/.zshrc grep PATH ~/.bash_profile head -n 10 ~/.profile source ~/.bashrc ``` ### PS-004: Systemd/launchd status commands (excluded) ```bash # Status and list commands are informational systemctl status nginx systemctl status sshd systemctl list-units systemctl list-unit-files launchctl list launchctl list com.apple.finder ``` ### PS-005: Reading authorized_keys (not modifying) ```bash # Reading is safe cat ~/.ssh/authorized_keys wc -l ~/.ssh/authorized_keys grep "user@host" ~/.ssh/authorized_keys ``` ## PI (Prompt Injection) - Safe Patterns ### PI-001: Safe instruction-like text ```bash # These are normal English sentences echo "Please ignore this file during the build" echo "This is a normal instruction manual" # Ignore whitespace changes in diff ``` ### PI-002: Safe HTML comments (TODO/FIXME/NOTE excluded) ```html ``` ## OB (Obfuscation) - Safe Patterns ### OB-001: Eval without variable expansion ```bash # Literal strings are safer eval 'echo hello' eval "echo world" ``` ### OB-002: Base64 decode without execution ```bash # Just decoding, not executing base64 -d encoded.txt > decoded.txt base64 --decode input.b64 -o output.bin echo 'SGVsbG8=' | base64 -d # Comments about base64 are safe # To decode base64: base64 -d file # Example: base64 decode the payload ``` ## Edge Cases and Boundary Tests ### Similar-looking but safe patterns ```bash # .service in filename (not systemd) cat /var/log/my.service.log mv backup.service.old backup.service.bak echo "Running customer.service.test" # .plist in documentation cat README.plist.md # The .plist file format is used by macOS # File extensions that look suspicious but aren't vim todo.service.md nano config.plist.yaml ``` ### String literals and documentation ```bash # Documenting dangerous commands (not executing) echo "Never run: rm -rf /" echo "Warning: chmod 777 is insecure" echo "Example: sudo apt update" # The sudo command requires password # Error messages echo "Error: /etc/passwd not found" echo "Cannot access ~/.ssh/id_rsa" ``` ### Package names and paths ```bash # Package names containing suspicious strings apt install openssh-server npm install @ssh2/ssh2 pip install python-crontab brew install cron-utils ```