janitor-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Security Scan

安全扫描

Heuristic scan of skill content for prompt-injection and malicious patterns.

针对Skill内容进行启发式扫描，检测提示注入和恶意模式。

Overview

概述

A skill is text your agent trusts: its SKILL.md is read as instructions and its scripts run on your machine. Public research (Snyk's ToxicSkills, 2026) found prompt injection in roughly a third of tested community skills. This scan flags the known bad shapes across every installed skill, in every scope (user, project, codex, plugin):

Injection phrases — "ignore all previous instructions", "do not tell the user"
Hidden instructions — imperative text in HTML comments (invisible when rendered), zero-width/bidi unicode between plain characters
Payload smuggling — large decodable base64 blobs in markdown
Dangerous scripts — network piped into a shell (
```
curl … | bash
```
), decode-and-execute, credential-store access (
```
~/.ssh
```
,
```
~/.aws
```
, keychain), URL shorteners, plain-HTTP calls, uploads of variable data

Findings are heuristics, not proof: a RISK verdict means "read this before trusting it". Legit tools trip these rules too (e.g. an installer that pipes curl into bash) — the point is that YOU see it and decide.

Skill是你的Agent信任的文本内容：它的SKILL.md会被当作指令读取，其脚本会在你的机器上运行。公开研究（Snyk的ToxicSkills项目，2026年）发现，约三分之一的社区测试Skill存在提示注入问题。此扫描会检查所有已安装Skill（涵盖用户、项目、代码库、插件等所有范围）中的已知风险模式：

注入语句 —— "忽略所有先前指令"、"不要告知用户"
隐藏指令 —— HTML注释中的命令式文本（渲染时不可见）、普通字符间的零宽度/双向Unicode字符
Payload走私 —— Markdown中的大型可解码base64块
危险脚本 —— 将网络内容管道传输至Shell（
```
curl … | bash
```
）、解码后执行、访问凭证存储（
```
~/.ssh
```
、
```
~/.aws
```
、钥匙串）、URL短链接、明文HTTP请求、上传可变数据

扫描结果为启发式判断，而非确凿证据：RISK verdict意味着“信任前请仔细查看”。合法工具也可能触发这些规则（例如使用curl管道到bash的安装程序）——核心是让你看到这些模式并自行判断。

Prerequisites

前置条件

Claude Code with the skills-janitor plugin installed (provides
```
scripts/security.sh
```
)
bash 3.2+ (the stock macOS bash works; no external dependencies, no network access)

安装了skills-janitor插件的Claude Code（提供
```
scripts/security.sh
```
）
bash 3.2+（macOS自带的bash即可；无外部依赖，无需网络访问）

Instructions

使用说明

Step 1: Run the scan

步骤1：运行扫描

bash

bash ~/.claude/skills/skills-janitor/scripts/security.sh           # all installed skills
bash ~/.claude/skills/skills-janitor/scripts/security.sh --json    # machine-readable
bash ~/.claude/skills/skills-janitor/scripts/security.sh --path ~/some/skill-dir   # one directory

bash

bash ~/.claude/skills/skills-janitor/scripts/security.sh           # 扫描所有已安装Skill
bash ~/.claude/skills/skills-janitor/scripts/security.sh --json    # 生成机器可读格式结果
bash ~/.claude/skills/skills-janitor/scripts/security.sh --path ~/some/skill-dir   # 扫描单个目录

Step 2: Present verdicts honestly

步骤2：如实呈现评估结果

Per-skill verdict: RISK (any HIGH finding), REVIEW (any MEDIUM), PASS. For each flagged skill show the finding titles, the file, and the evidence snippet. Do NOT call a finding "malware" — describe what the pattern does and let the user judge intent (e.g. "media-use pipes a HeyGen installer from the network into bash — a common install pattern, but verify the URL before trusting it").

每个Skill的评估结果：RISK（存在任何高风险发现）、REVIEW（存在任何中风险发现）、PASS。对于每个标记的Skill，需展示发现标题、涉及文件以及证据片段。请勿直接称某发现为“恶意软件”——描述该模式的行为，由用户判断意图（例如：“media-use将HeyGen安装程序从网络管道传输至bash——这是常见的安装模式，但信任前请验证URL”）。

Step 3: Recommend next steps

步骤3：推荐后续操作

RISK on a skill the user doesn't recognize or need →
```
/janitor-swipe
```
or delete it outright
RISK on a known/trusted tool → read the flagged file once, then move on
Before installing something new →
```
/janitor-discover <url>
```
runs this same scan pre-install

若不认识或不需要存在RISK的Skill → 使用
```
/janitor-swipe
```
或直接删除
若已知/信任的工具显示RISK → 查看标记的文件后即可继续使用
安装新Skill前 → 使用
```
/janitor-discover <url>
```
在安装前运行此扫描

Output

输出

Summary line (

Scanned: N | RISK: x | REVIEW: y | PASS: z

) followed by flagged skills, each with severity-tagged findings, the file, and an evidence snippet.

--json

emits the full structured report.

首先显示汇总行（

已扫描：N | RISK：x | REVIEW：y | PASS：z

），随后列出标记的Skill，每个Skill包含带严重程度标签的发现、涉及文件和证据片段。使用

--json

参数可输出完整结构化报告。

Error Handling

错误处理

Error:
```
security.sh: No such file or directory
```
Solution: The plugin is installed under a different root — locate it with
```
ls ~/.claude/skills
```
or check the plugin cache.
Error: Everything shows PASS but the user expected a finding Solution: The scan covers markdown and script files up to 1MB, 200 files per skill; binaries and huge files are skipped. Check the specific file manually.
Error: A trusted skill shows RISK Solution: Expected for tools that legitimately use flagged patterns (installers, credential helpers). Read the evidence line — if it matches the tool's documented purpose, note it and move on. Verdicts are advisory; nothing is deleted.

错误：
```
security.sh: No such file or directory
```
解决方案：插件安装在不同根目录下——使用
```
ls ~/.claude/skills
```
定位或检查插件缓存。
错误：所有结果显示PASS，但用户预期应有发现 解决方案：扫描覆盖大小不超过1MB的Markdown和脚本文件，每个Skill最多扫描200个文件；二进制文件和超大文件会被跳过。请手动检查特定文件。
错误：受信任的Skill显示RISK 解决方案：合法使用标记模式的工具（如安装程序、凭证助手）出现此情况属于正常。查看证据行——若与工具的文档用途相符，记录后即可继续。评估结果仅作参考；不会自动删除任何内容。

Examples

示例

Example 1: Full audit

示例1：全面审计

Input: "Are my skills safe? Check for prompt injection."

Output: Run the scan, lead with the summary ("178 scanned, 2 RISK, 0 REVIEW"), then explain each flagged skill in plain language with its evidence, and close with a recommendation per skill.

输入：“我的Skill安全吗？检查是否存在提示注入。”

输出：运行扫描，先展示汇总信息（“已扫描178个，2个RISK，0个REVIEW”），然后用通俗语言解释每个标记Skill的发现及证据，最后针对每个Skill给出建议。

Example 2: One suspicious folder

示例2：扫描可疑文件夹

Input: "Scan ~/Downloads/cool-skill before I install it."

Output: Run with

--path ~/Downloads/cool-skill

and present the verdict; suggest

/janitor-discover

for the overlap check too.

输入：“在我安装前扫描~/Downloads/cool-skill。”

输出：使用

--path ~/Downloads/cool-skill

运行扫描并呈现评估结果；同时建议使用

/janitor-discover

进行重叠检查。