The rules
Rules version 2026-10-19.3. Each rule is a text pattern taken from published attacks on agents and their skills. A match means "look at this line", not "this is malicious": security tools, for example, quote these patterns on purpose. People decide.
| Rule | Severity | Pattern | Why it matters |
|---|---|---|---|
| FS-EXE-001 | High | A download piped straight into a shell | Runs whatever the remote server sends, unseen, with your agent's permissions. |
| FS-EXE-002 | High | A shell running a download as a command | Runs remote content through sh -c or eval. |
| FS-EXE-003 | High | PowerShell running downloaded code | Invoke-Expression on downloaded text runs it unseen. |
| FS-EXE-004 | High | Decoded base64 piped into a shell | Hides the real command from anyone reading the file. |
| FS-EXE-005 | High | A downloaded file made executable | Downloads a program and prepares it to run. |
| FS-SEC-001 | High | Reads SSH private keys | SSH private keys give access to servers and code. |
| FS-SEC-002 | High | Reads cloud or developer credentials | These files hold long-lived access keys. |
| FS-SEC-003 | High | Reads an agent's own key file | An agent's .env or credentials file holds every API key it has (the most common skill theft target). |
| FS-SEC-009 | Medium | Reads a key file inside a skill folder | A skill reading its own .env is common; check nothing else reads it. |
| FS-SEC-007 | Medium | Reads a .env file | A .env file usually holds API keys; check where its contents go next. |
| FS-SEC-004 | High | Reads crypto wallets or seed phrases | Wallet files and seed phrases are enough to take the funds. |
| FS-SEC-005 | High | Reads saved browser passwords | Saved passwords sign in as you everywhere. |
| FS-SEC-010 | Medium | Reads a secret from the system keychain | Fine for a skill's own key; check which item it reads and where it goes. |
| FS-SEC-008 | Medium | Uses browser cookies | Browser cookies carry signed-in sessions; check where they go. |
| FS-SEC-006 | Medium | Collects environment variables or tokens | Dumping the environment exposes every key the agent holds. |
| FS-EXF-001 | High | Sends data to a throwaway collection endpoint | Services like these are used to receive stolen data. |
| FS-EXF-003 | Medium | Posts to a chat bot or tunnel | Telegram, Discord webhooks and tunnels are common for alerts, and also for leaking data. |
| FS-EXF-002 | Medium | Uploads files or secrets to a remote server | An upload of local files or keys leaves your machine. |
| FS-HID-001 | High | Hidden text in invisible characters | Tag characters and runs of zero-width characters can carry instructions people can't see but models read (ASCII smuggling). |
| FS-HID-004 | Medium | An invisible character | A single zero-width character is often harmless formatting, but worth a look. |
| FS-HID-002 | High | Text-direction override characters | Bidirectional controls make text display differently from what it says. |
| FS-HID-003 | Medium | Instructions inside an HTML comment | Comments are hidden when the file is rendered, but models still read them. |
| FS-INJ-001 | Medium | An instruction to ignore earlier instructions | The classic prompt-injection opening. |
| FS-INJ-002 | Medium | An instruction to keep something from the user | A skill should never need to hide what it does. |
| FS-INJ-003 | Medium | A fake system or role message | Text pretending to be the system prompt or a new role. |
| FS-PER-001 | Medium | Changes the agent's standing files or memory | Writing to heartbeat, memory or instruction files makes a change outlive the task. |
| FS-PER-002 | Medium | Installs a scheduled task or shell start-up hook | Runs again later without anyone asking. |
| FS-REM-001 | Medium | Fetches remote text and follows it | Whoever controls that URL can change what your agent does at any time (the Moltbook heartbeat pattern). |
| FS-REM-002 | Medium | Re-fetches instructions on a timer | A periodic fetch of instructions is a standing remote control. |
| FS-MON-001 | Medium | Sends cryptocurrency to a fixed address | A hard-coded payout address is a common scam pattern. |
| FS-DES-001 | High | Deletes the home or root directory | Irreversible data loss. |
| FS-PRM-001 | Medium | Turns off the agent's permission prompts | Removes the human check on every later action. |
| FS-PRM-002 | Low | Asks for administrator rights | sudo gives the command full control of the machine. |
| FS-OBF-001 | Low | A long encoded blob | Long base64 or hex text can hide a payload from readers. |
High-risk pattern: at least one high-severity match. Medium-risk pattern: medium only. The scanner reads text; it doesn't run anything, so it can miss attacks that only show when code runs. Found a false match or a pattern we miss? Tell us.