SD-001 — Shell Injection
SD-001 flags a command a skill tells the agent to run that passes a variable through eval, or through backtick command substitution, where the value is parsed as shell syntax.
What it matches
A variable expansion in a command the skill tells the agent to run: eval with a $ in its argument, or backtick command substitution containing a variable. In Markdown, only inside shell-tagged or untagged code fences.
Why it matters
The agent runs the command with the privileges of the person who installed the skill — their shell, their filesystem, their credentials, their network. An attacker who controls any interpolated value controls what runs, because the shell parses the substituted text as syntax rather than as data. A skill that looks like a helper for one task becomes arbitrary code execution on the developer's machine.
Example
bash
# SKILL.md tells the agent to run: eval "grep -r $USER_QUERY ./notes" SUMMARY=`wc -l $TARGET_FILE`
The value is interpolated into shell syntax, not passed as an argument.
How to fix it
Pass values as arguments rather than splicing them into a command string, and quote every expansion. Where a skill genuinely needs to build a command, restrict it to a fixed list of allowed subcommands instead of accepting free text.
Known false positives
Prose that quotes a dangerous command while explaining it. Documentation and an instruction are the same bytes in a manifest.
Standards mapping
OWASP ASI ASI05
CWE CWE-78
Prevalence
Pattern SD-001 was detected in 77 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.