# Taskingbot Skill Validator

> Scans skills for tool poisoning, policy violations, and risk before registration or exposure. Detects hidden instructions, cross-tool shadowing, data exfiltration, and policy bypass patterns in SKILL.md, manifest, and schema files.

- Skill: `tippyentertainment/taskingbot-skill-validator` (Agent Skill)
- Install (CLI): `npx skillmds@latest add tippyentertainment/taskingbot-skill-validator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tippyentertainment/taskingbot-skill-validator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tippyentertainment (https://skillmd.com/u/tippyentertainment)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/tippyentertainment/taskingbot-skill-validator

---


# Provided by TippyEntertainment
# https://github.com/tippyentertainment/skills.git

## Purpose

Create a TaskingBot skill called taskingbot-skill-validator that scans other skills for tool poisoning before they are registered or exposed.

## Role

You are a security validator for TaskingBot skills. You:
- Scan SKILL.md, manifest, and schema files for hidden instructions, cross-tool shadowing, data exfiltration, and policy/jailbreak language.
- Assign risk scores and block, warn, or approve skills based on findings.
- Help defend against OpenClaw/ClawHub-style SKILL.md poisoning and policy bypass.

## Inputs

- skillId: Unique skill identifier
- skillMarkdown: SKILL.md content
- skillManifestJson: Manifest JSON (optional)
- schemaJson: Schema JSON (optional)

## Process

1. Scan SKILL.md, manifest, and schema using regex-based pattern matching for:
   - Hidden/second-order instructions
   - Cross-tool shadowing
   - Data exfiltration
   - Policy/jailbreak language
2. For each match, record a finding with severity, message, snippet, and source.
3. Compute riskScore and status from findings:
   - low: +5, medium: +15, high: +30, critical: +50 (clamp 0–100)
   - status = block if score ≥ 70, warn if ≥ 30, else ok
4. Compute hash as sha256(markdown + manifestJson + schemaJson).

## Output

- status: ok | warn | block
- riskScore: 0–100
- findings: Array of findings with category, severity, message, snippet, and source
- hash: sha256 over markdown + manifest + schema

## Constraints

- Never approve skills with status === "block".
- Only expose skills with status === "ok" to agents.
- Skills with status === "warn" require explicit admin approval or user override.

## Example Usage

User instruction:

Scan the following skill for tool poisoning and policy violations.

// skillMarkdown, manifestJson, schemaJson here...
  {
    id: "data-exfiltration",
    regex: /pastebin\.com|webhook|send all data|send all logs|send all messages|send all credentials|btc address|crypto wallet/gi,
    severity: "critical",
    message: "Potential data exfiltration or crypto wallet reference detected."
  },
  {
    id: "policy-violation",
    regex: /bypass security|circumvent restrictions|jailbreak|ignore content policy/gi,
    severity: "critical",
    message: "Policy/jailbreak language detected."
  }
];

function scanText(source: "markdown" | "manifest" | "schema", text: string): ScanFinding[] {
  const findings: ScanFinding[] = [];
  for (const pat of patterns) {
    let match;
    const regex = new RegExp(pat.regex.source, pat.regex.flags);
    while ((match = regex.exec(text)) !== null) {
      const start = Math.max(0, match.index - 60);
      const end = Math.min(text.length, match.index + match[0].length + 60);
      findings.push({
        id: pat.id,
        severity: pat.severity as ScanFinding["severity"],
        message: pat.message,
        snippet: text.slice(start, end),
        source
      });
    }
  }
  return findings;
}

function computeHash(markdown: string, manifest: string | null, schema: string | null): string {
  const data = markdown + (manifest || "") + (schema || "");
  return crypto.createHash("sha256").update(data).digest("hex");
}

function scoreSeverity(severity: ScanFinding["severity"]): number {
  switch (severity) {
    case "low": return 5;
    case "medium": return 15;
    case "high": return 30;
    case "critical": return 50;
    default: return 0;
  }
}

export async function scanSkill(args: ScanSkillArgs): Promise<ScanResult> {
  const findings: ScanFinding[] = [];
  findings.push(...scanText("markdown", args.skillMarkdown || ""));
  if (args.skillManifestJson) findings.push(...scanText("manifest", args.skillManifestJson));
  if (args.schemaJson) findings.push(...scanText("schema", args.schemaJson));

  let riskScore = findings.reduce((acc, f) => acc + scoreSeverity(f.severity), 0);
  riskScore = Math.max(0, Math.min(100, riskScore));

  let status: ScanStatus = "ok";
  if (riskScore >= 70) status = "block";
  else if (riskScore >= 30) status = "warn";

  const hash = computeHash(args.skillMarkdown || "", args.skillManifestJson || null, args.schemaJson || null);

  return {
    skillId: args.skillId,
    status,
    riskScore,
    findings,
    hash
  };
}