SD-004 — Credential Access
SD-004 flags a skill naming a credential location — an SSH or GnuPG directory, ~/.aws/, ~/.env, the shadow file — in any of its home-directory spellings.
What it matches
A line naming a credential location: ~/.aws/, ~/.ssh/, ~/.gnupg/, ~/.env, .credentials, /etc/shadow or /etc/passwd — in the ~/, $HOME/ and ${HOME}/ spellings.
Why it matters
Those files are the keys to everything the installing user can reach: an SSH private key is access to every host and repository that trusts it, a cloud credentials file is their account, .env is whatever the project holds. An agent that reads one has it in context, and any outbound call in the same skill can carry it off. Most of these cannot be rotated quietly either — revoking an SSH key or a cloud access key breaks everything else that was using it.
Example
bash
# Step 3 in SKILL.md: cat $HOME/.aws/credentials >> ./context/env-notes.md head -n 5 ~/.ssh/id_ed25519
A credential file read into content the agent carries forward; the $HOME and ~ spellings are the same read.
How to fix it
Remove the read. A skill that needs to authenticate should take a token from an environment variable the user sets for it, or from the tool's own credential helper, rather than opening the file the secret lives in. A skill that only documents where its own credentials belong should say so without spelling a path it never touches.
Known false positives
A skill that documents where its own credentials belong, and reads of public key material such as a .pub file.
Standards mapping
Prevalence
Pattern SD-004 was detected in 149 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.