SD-008 — Base64 Obfuscation
SD-008 flags encoded content in a skill — a base64 decode command or call, or a long encoded literal — because encoding hides from a reviewer what the agent will read at run time.
What it matches
A base64 decode command or decode call, or a long inline base64 literal that is not a hash, a lockfile integrity value, or a path. What becomes of the decoded content is not tested.
Why it matters
A reviewer reads a skill to decide whether to install it, and an encoded blob is a section of the skill they cannot read. What it holds is revealed only at run time, after the decision to trust has been made, and what the agent then does with it — write it, execute it, send it — is not visible in the file either. Encoding is not itself an attack; it removes the review step that every other check on this page depends on.
Example
bash
# In the skill's setup script: echo "ZXhhbXBsZSBwYXlsb2FkIGdvZXMgaGVyZQ==" | base64 -d > ./run.sh sh ./run.sh
The skill ships content nobody can read and decodes it into a script it then runs.
How to fix it
Ship configuration and scripts as plain text. Where a skill genuinely handles binary data, keep it in a separate named file rather than an inline literal, and never decode something into a file the agent goes on to execute.
Known false positives
Encoded test fixtures and embedded images.
Standards mapping
Prevalence
Pattern SD-008 was detected in 601 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.