wonderwhy-er/DesktopCommanderMCP

Why it got this result

Desktop Commander registers filesystem tool names (read_file, write_file, create_directory, list_directory, move_file, get_file_info, read_multiple_files) that overlap names used by the official MCP reference filesystem server, but every shipped launch configuration (.mcp.json, Claude and Cursor plugin manifests) declares only the desktop-commander server identity, and the tool registration code builds its list independently with no merge against, or collision check with, another server's names. No client-side merge, silent shadowing, or bypass of server-qualified routing is present in the shipped configurations, so the overlapping names alone do not establish an exploitable collision in this deployment.

Why it matters

Prevents malicious tool shadowing.

Evidence

{
    name: "read_file",
    description: `

{
    name: "write_file",
    description: `

server.setRequestHandler(ListToolsRequestSchema, async () => {
    try {
        const showMcpUiPreviews = await shouldShowMcpUiPreviews();
        const allTools = [
            // Configuration tools
            {
                name: "get_config",
                description: `

+1 more location in the finding JSON

Why it got this result

Manual review of every tool description string in src/server.ts (and the shared CMD_PREFIX_DESCRIPTION / SERVER_INSTRUCTIONS constants) found only functional usage text, no hidden directives, no zero-width/bidi control characters (checked programmatically for U+200B/U+200C/U+200D/U+202E/U+202A/U+2066/U+2069/U+FEFF across all tool-facing strings), and no ANSI escape sequences or 'ignore previous instructions'-style covert directives. Descriptions only explain functional behavior (pagination, format handling, security notes for set_config_value) in plain language surfaced identically to what a developer reading the source sees.

Why it matters

Prevents covert model manipulation.

Evidence

description: `
        Set a specific configuration value by key.
        
        Security note: configuration changes affect later file and command behavior.
        Isolating them from untrusted file or command content reduces the chance that external content influences configuration.
        
        Config keys include: ...`

Why it got this result

The MCP server itself exposes only a stdio transport (src/index.ts, FilteredStdioServerTransport) — no streamable_http/SSE/HTTP transport exists for MCP clients, so the MCP Authorization spec's OAuth requirement does not attach to this surface. The separate 'remote' subcommand (src/remote-device/) is an optional outbound bridge that uses OAuth2 Device Authorization Grant + PKCE (src/remote-device/device-authenticator.ts) against the vendor's own hosted backend to relay tool calls over Supabase Realtime — this is a device/client flow with PKCE already implemented, not the MCP client↔server transport the rule targets, and does not change the base server's stdio-only classification.

Why it matters

Misconfig enables token theft and confused-deputy attacks.

Evidence

async function runServer() {
  try {
    if (process.argv[2] === 'setup') { ... }
    if (process.argv[2] === 'remove') { ... }
    if (process.argv[2] === 'remote') {
      await runRemote();
      return;
    }
    ...
    const transport = new FilteredStdioServerTransport();

Why it got this result

Rule requires a remote transport (requires_remote_transport=true). The MCP server binds no network listener at all — it communicates over stdio, which is gated by the OS process boundary (whatever spawns the process, e.g. Claude Desktop). No bare ':PORT' or '0.0.0.0' bind exists anywhere in src/ for the MCP protocol itself.

Why it matters

Prevents unauthorized tool use and data access.

Evidence

const transport = new FilteredStdioServerTransport();
global.mcpTransport = transport;

Why it got this result

Desktop Commander is not an OAuth proxy forwarding authorization to a distinct upstream IdP on behalf of dynamically-registered MCP clients. The only OAuth-like flow in the repo is the optional 'remote device' feature (src/remote-device/device-authenticator.ts), where the local device itself authenticates (Device Authorization Grant + PKCE) directly to the vendor's own backend to enable remote relay of tool calls — there is no MCP-client registration endpoint, no shared upstream client_id proxied on behalf of third-party MCP clients, and no bridge-code minting pattern. Q1/Q2 of the evaluation method do not apply.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

async authenticate(deviceId?: string): Promise<AuthSession> {
    console.log('🔐 Connecting this computer...\n');
    const pkce = this.generatePKCE();
    const deviceAuth = await this.requestDeviceCode(pkce.challenge, deviceId);
    this.displayUserInstructions(deviceAuth);
    const tokens = await this.pollForAuthorization(deviceAuth, pkce.verifier);
    console.log('✅ Device verified\n');
    return tokens;
}

Why it got this result

Desktop Commander's MCP protocol surface is stdio-only. src/index.ts constructs a FilteredStdioServerTransport and calls server.connect(transport) — there is no HTTP/SSE/StreamableHTTP listener for the MCP protocol itself anywhere in the codebase (grep for .listen(/createServer/express() across src/ only finds an ephemeral 127.0.0.1-bound helper server for PDF rendering, unrelated to MCP transport). Rule applicability requires_remote_transport=true, which is not met.

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Evidence

// Create transport FIRST so all logging gets properly buffered
// This must happen before any code that might use logger.*
const transport = new FilteredStdioServerTransport();

// Export transport for use throughout the application
global.mcpTransport = transport;

Why it got this result

No network listener is bound for the MCP protocol; the only createServer()/.listen() call in the repo is an ephemeral helper bound explicitly to 127.0.0.1 for local PDF/Chrome rendering (src/tools/pdf/markdown.ts:608,621), not an MCP transport. requires_remote_transport=true is not satisfied.

Why it matters

LAN/Internet exposure enables remote exploitation.

Evidence

const server = createServer((request, response) => {
 ...
});
...
server.listen(0, '127.0.0.1', resolve);

Why it got this result

No HTTP/CORS surface exists for the MCP protocol (stdio-only); requires_remote_transport=true is not met.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

const transport = new FilteredStdioServerTransport();
global.mcpTransport = transport;

Why it got this result

MCP transport is local stdio only; no remote listener requiring TLS exists in this component. requires_remote_transport=true is not met.

Why it matters

MitM can steal tokens and tamper responses.

Evidence

const transport = new FilteredStdioServerTransport();
global.mcpTransport = transport;

Why it got this result

Reviewed all skill artifacts in scope at repo root not individually registered (desktop-commander-overview/SKILL.md, terminal/SKILL.md, identically duplicated under skills/, plugins/claude/skills/, plugins/cursor/skills/) plus the repo's plugin/MCP manifests (plugin.json, plugin.yaml, gemini-extension.json, .mcp.json, manifest.template.json, config.json). desktop-commander-overview and terminal both describe the exact tool surface the Desktop Commander MCP exposes (process/shell, file I/O, search, SSH) -- the manifests declare the same capability set (terminal-control, file-search, file-system-operations, excel/pdf/docx support) that the skill text uses. No undisclosed network egress, credential harvesting, or hidden exec capability found in any model-facing carrier.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: Use for Desktop Commander MCP capabilities — persistent shells and
  REPLs, long-running processes, filesystem beyond the workspace, structured
  files (.xlsx, .docx, .pdf, images) and large local data files such as CSVs,
  ripgrep search at scale, SSH, or cross-turn state.
# Desktop Commander MCP
Desktop Commander gives the agent reach across the user's actual computer —
files, folders, terminals, processes, structured documents, and remote
machines reachable over SSH.

Why it got this result

A YARA signature (Zeus_Metadata_Consent_Suppression) flagged a cluster at lines 20-84 of desktop-commander-overview/SKILL.md (identically present under skills/, plugins/claude/skills/, and plugins/cursor/skills/). Manual review of that exact cluster (the attestation object was not available in this session) shows the opposite of consent suppression: the text explicitly instructs the host to OBTAIN confirmation before privileged actions -- 'Before running production-impacting SSH commands, explain the intended action and get user confirmation when the risk is non-trivial' (line 36) and 'Before deploys, restarts, migrations, or other environment-changing commands, summarize the action and confirm with the user unless they already explicitly asked for that exact operation' (line 42). This is a negative-indicator match (prose explicitly defers to host consent gate) and the YARA hit is assessed as a false positive on this reading. The terminal/SKILL.md (also only at root/plugin level, not individually registered) similarly instructs 'Never run destructive commands without explicit confirmation' and devotes a full safety section (S7) to requiring confirmation before destructive commands. No consent-suppression prose was found anywhere in the root-level skill/plugin manifests or instruction bodies.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

### "Debug this production issue"
Before running production-impacting SSH commands, explain the intended
action and get user confirmation when the risk is non-trivial.
...
### "Deploy this to staging"
Before deploys, restarts, migrations, or other environment-changing
commands, summarize the action and confirm with the user unless they
already explicitly asked for that exact operation.

## 7. Safety: destructive commands and chaining
Beyond that list, treat these as **destructive — never run without the
user's explicit confirmation**, even if they'd technically succeed:
- Recursive/forced deletes: `rm -rf`...

Why it got this result

The onboarding workflow in desktop-commander-overview/SKILL.md explicitly uses get_recent_tool_calls to retrieve prior tool arguments and outputs for last-session reconstruction (lines 90-92). This constitutes a conversation/tool-history read, which brings the artifact within this rule's mechanism-agnostic context-read test. The recovered history stays in-session and is returned to the user; no instruction directs it to any external destination, so no harvest-plus-exfiltration pair exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Operating etiquette
- Preview risky commands before running; run read-only inspection first.
- Use absolute paths; respect `allowedDirectories`.
- Never print secrets, tokens, or passwords into output; redact if they appear.

Why it got this result

The root ships a format-native install-time lifecycle primitive via package.json's postinstall hook, which runs track-installation.js and verify-ripgrep.js. track-installation.js only reads an existing client ID or generates an in-memory fallback UUID when none exists; it does not create a persisted ID file or config directory. verify-ripgrep.js resolves the bundled ripgrep binary and repairs its executable permissions (chmod 0755 on Unix) as part of normal installation -- a purpose-matched executable repair, not a covert directive or payload delivery. Neither script rewrites host control-plane/memory files, exports exec-enabling environment variables, or repoints any LLM provider endpoint. No covert persistence or endpoint-substitution was found.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

"postinstall": "node dist/track-installation.js && node dist/npm-scripts/verify-ripgrep.js || node -e \"process.exit(0)\""

// Telemetry proxy configuration (same as setup script)
const TELEMETRY_PROXY_URL = 'https://telemetry.desktopcommander.app/mp/collect';
[REDACTED]

{
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }
}

Why it got this result

gemini-extension.json declares 'excludeTools': [] (no tools excluded = full MCP toolset available), and package manifests declare no narrower allowed-tools/OAuth scope. However, this is broad-but-justified: the product's entire declared purpose across every manifest (plugin.json, plugin.yaml, gemini-extension.json, server.yaml) IS full terminal/filesystem/process-management access ('MCP server for terminal commands, process management, and file operations'), disclosed prominently in README/FAQ/PRIVACY.md, so the broad grant matches the documented function rather than exceeding it. No wildcard grant is paired with a narrower stated purpose (the false-positive guard for intrinsic broad capability applies). The desktop-commander-overview and terminal skill texts (no allowed-tools frontmatter) likewise only describe using the already-disclosed, purpose-matched tool surface.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "desktop-commander",
  "version": "1.5.0",
  "description": "MCP server for terminal commands, process management, and file operations across text, code, PDF, DOCX, Excel, images, and structured data",
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander"]
    }
  },
  "excludeTools": []
}

Why it got this result

Codepoint-scanned desktop-commander-overview/SKILL.md and terminal/SKILL.md (identically present under skills/, plugins/claude/skills/, plugins/cursor/skills/) plus the root plugin/MCP manifests (plugin.json, plugin.yaml, gemini-extension.json, .mcp.json, manifest.template.json, config.json, server.yaml, smithery.yaml). No zero-width/bidi/Tag-block codepoints, mixed-script confusables, forged chat-template/role tokens, or ANSI/OSC escapes were found in any model-facing carrier; no HTML-comment/CSS-hidden concealment patterns. The YARA hit on desktop-commander-overview/SKILL.md (addressed under ATR-P0002) was reviewed in full -- it is plain, visible, ASCII prose requiring user confirmation, with no forged/concealed content.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(codepoint scan of desktop-commander-overview/SKILL.md and terminal/SKILL.md: no concealment codepoints, no forged chat-template tokens, no HTML-comment/CSS-hidden text, no ANSI escapes found)

Why it got this result

The repo's own declared identity ('desktop-commander' / 'Desktop Commander' / '@wonderwhy-er/desktop-commander') is published from the verifiable genuine owner -- git remote origin is github.com/wonderwhy-er/DesktopCommanderMCP, matching the publisher named in every manifest (plugin.json author, package.json, server.json repository field). No near-miss/homoglyph of a well-known brand, no trust-implying prefix, no version-spoofing suffix, and no fork/official-replacement claims against a third party were found across the root-level manifests (plugin.json, plugin.yaml, gemini-extension.json, server.json, server.yaml, smithery.yaml) or the desktop-commander-overview/terminal skill text.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "io.github.wonderwhy-er/desktop-commander",
  "title": "Desktop Commander",
  "repository": {
    "url": "https://github.com/wonderwhy-er/DesktopCommanderMCP",
    "source": "github"
  },
  "version": "0.3.0"

Why it got this result

The plugin manifest declares exactly one capability class: launching the Desktop Commander MCP server for terminal/process/file operations. All six bundled skills only direct the model to call that MCP's own already-registered tools for exactly the workflows the manifest/README describe. No bundled script, no outbound network call to a non-documented host, no undisclosed credential read, and no undeclared subprocess/eval was found (only SKILL.md/README.md/plugin.json files exist under plugins/claude).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "name": "desktop-commander",
  "description": "MCP server for terminal commands, process management, and file operations...",
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }
}

## Components

- MCP server: `desktop-commander`...
- Skill: `desktop-commander-overview`
- Skill: `terminal`
- Skill: `computer-health-check`
- Skill: `ai-tools-setup`
- Skill: `knowledge-base`
- Skill: `obsidian-vault`

Why it got this result

The plugin manifest registers only skill files and the MCP server launch; it contains no approval-bypass or consent-suppression instructions. The ai-tools-setup skill requires redaction of secrets and backups before edits, and the knowledge-base skill asks clarifying questions for ambiguous tasks, but neither skill contains an explicit per-action confirmation requirement. The verdict rests on the absence of any affirmative consent-suppression or self-authorizing language in the bundled instructions, not on an explicit all-write confirmation guarantee.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   concrete working alternative instead of retrying the same thing.
4. **Never echo secrets.** API keys, tokens, and passwords go *into the right
   config or `.env` file* — never repeated back in chat. If a user pastes a live
   secret, warn them, use it, and suggest they rotate it if it was shared

{
  "name": "desktop-commander",
  "description": "MCP server for terminal commands, process management, and file operations...",
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }
}

Why it got this result

The ai-tools-setup skill reads MCP client configuration files and provider API keys for its declared installation/repair purpose, and additionally performs a provider key validation check via an outbound request to the provider's own endpoint -- this is sanctioned authentication to the user-selected provider, not an exfiltration channel. The desktop-commander-overview skill reads recent tool outputs for its declared overview function. No instructed destination exists for forwarding secrets or conversation history to a third party; output summaries redact secrets and conversation history is not persisted outside the session.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

   concrete working alternative instead of retrying the same thing.
4. **Never echo secrets.** API keys, tokens, and passwords go *into the right
   config or `.env` file* — never repeated back in chat. If a user pastes a live
   secret, warn them, use it, and suggest they rotate it if it was shared

## Safety

- Only add MCP servers from sources the user trusts; an MCP server runs with the
  user's privileges.
- Back up before editing; redact secrets in summaries; restart the client to
  apply changes.

Why it got this result

The plugin manifest declares a single, narrow capability: launching the Desktop Commander MCP server. There is no wildcard/catch-all permission block (no "permissions": ["*"]", no broad OAuth scope), and no bundled skill's frontmatter declares an allowed-tools list at all, so there is no self-declared capability class that exceeds the stated purpose. No package.json bin/postinstall or lifecycle hook is shipped.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "desktop-commander",
  "description": "MCP server for terminal commands, process management, and file operations...",
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }
}

Why it got this result

Codepoint-scanned all 24 files under the in-scope component directories (Python regex for zero-width/bidi-override/Tag-block chars U+200B-200D/2060/FEFF/202A-202E/2066-2069/E0000-E007F) -- zero matches. Also grepped for forged chat-template tokens (<|im_start|>, [INST], <start_of_turn>, etc.) and 'ignore previous instructions' style imperatives -- none found. All model-facing text is plain ASCII/UTF-8 prose matching the rendered view.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(scanned; no zero-width/bidi/tag-block codepoints, no forged chat-template tokens, no homoglyph substitution found)

Why it got this result

The declared identity 'desktop-commander' matches the canonical name of this project's own product (repository wonderwhy-er/DesktopCommanderMCP, the genuine publisher). No near-miss/typosquat of a third-party brand, no trust-implying prefix, no version/tier-spoofing suffix, and no impersonation prose claiming to be an official/updated build of someone else's tool.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "desktop-commander",
  "displayName": "Desktop Commander",
  "version": "0.2.0",
  "description": "MCP server for terminal commands, process management, and file operations...",
  "author": {
    "name": "Desktop Commander",
    "email": "[REDACTED]"
  },

Why it got this result

plugins/claude ships no lifecycle/event hook (no .claude/settings.json PreToolUse/PostToolUse, no before_tool_callback), no entry-script/dotenv/git-hook files, and no exec-enabling or LLM-endpoint-substituting env assignment. Its only control-plane-adjacent artifact is the declared MCP server launch line in plugin.json (npx -y @wonderwhy-er/desktop-commander@latest), which per this rule's own false-positive guard is 'not by itself format-native out-of-band execution' -- an unpinned launch package is explicitly carved out to ATR-P0007, not this rule. No other primitive exists, so there is no out-of-band execution surface for this rule to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

{
  "name": "desktop-commander",
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }
}

Why it got this result

The plugin manifest/README declare exactly what the bundle provides: an MCP server plus listed skills/rule steering the agent toward Desktop Commander tool use. No hidden components beyond what README.md enumerates were found in the directory listing.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

# Desktop Commander Cursor Plugin
...
## Components
- MCP server: `desktop-commander`, installed with `npx -y @wonderwhy-er/desktop-commander@latest`.
- Rule: `rules/desktop-commander-default.mdc` ...
- Skill: `desktop-commander-overview` ...
- Skill: `terminal` ...

Why it got this result

The always-on rule only steers tool preference ('prefer Desktop Commander MCP ... for local filesystem, terminal, process, search'); it contains no language suppressing confirmation or bypassing guardrails, and points to the (confirmation-reinforcing) overview skill for detailed guidance.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
description: Prefer Desktop Commander MCP for local filesystem, terminal, process, search, and workspace operations.
alwaysApply: true
---
For local filesystem, terminal, process, search, and workspace operations, prefer Desktop Commander MCP, especially for persistent shells, long-running processes, file reads, structured documents, large local data files, SSH workflows, and process inspection.

Why it got this result

The bundled overview skill reads recent tool-call context and the setup skill reads configured credentials/config values as part of their declared functionality. Both handle this data in-session: credentials are redacted and sent only to the requested provider, with no separate collection destination or exfiltration sink identified across the six bundled skills and their references.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

# Desktop Commander Cursor Plugin
Desktop Commander gives Cursor agents access to a local MCP server for terminal sessions, filesystem work, structured documents, search, process management, and SSH workflows ...

Why it got this result

plugin.json declares only the mcpServers entry, skills path, and rules path needed to deliver the bundle's stated purpose; no additional OS-level permissions, broad host access declarations, or unrelated capability grants are present in the manifest.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

"skills": "./skills/",
  "rules": "./rules/",
  "mcpServers": {
    "desktop-commander": {
      "command": "npx",
      "args": ["-y", "@wonderwhy-er/desktop-commander@latest"]
    }
  }

Why it got this result

No hidden unicode control characters or concealed directives found in plugin.json, README.md, or the rule .mdc file.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
description: Prefer Desktop Commander MCP for local filesystem, terminal, process, search, and workspace operations.
alwaysApply: true
---
For local filesystem, terminal, process, search, and workspace operations, prefer Desktop Commander MCP ...

Why it got this result

plugin.json publisher/author/homepage/repository fields ('Desktop Commander', desktopcommander.app, github.com/wonderwhy-er/DesktopCommanderMCP) match the upstream project exactly and consistently across .claude-plugin, .cursor-plugin, and package.json; no name confusable with a different, unrelated popular project was found.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "desktop-commander",
  "displayName": "Desktop Commander",
  "version": "0.1.0",
  ...
  "author": {
    "name": "Desktop Commander",
    "email": "[REDACTED]"
  },
  "publisher": "Desktop Commander",
  "homepage": "https://desktopcommander.app",
  "repository": "https://github.com/wonderwhy-er/DesktopCommanderMCP",

Why it got this result

The plugin's declared MCP server launch entry is an ordinary declared server launch excluded from this rule's scope. The remaining bundled files are Markdown prose (the always-on rule, skill guidance, and references) containing no executable hooks, hostile environment assignments, or covert host-control directives; the unpinned @latest launch concern is addressed instead under the package-provenance/rug-pull rule.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
description: Prefer Desktop Commander MCP for local filesystem, terminal, process, search, and workspace operations.
alwaysApply: true
---
For local filesystem, terminal, process, search, and workspace operations, prefer Desktop Commander MCP ...

Why it got this result

The SKILL.md frontmatter description ('Set up, connect, validate, and repair Claude Desktop and MCP servers using Desktop Commander') matches the body content exactly: golden rules for config editing, backups, and verification, plus three reference files for Claude Desktop/OpenClaw/Hermes setup. No behavior in the body (install/config/diagnose local AI tooling) exceeds or diverges from the declared trigger phrases.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: ai-tools-setup
...
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers using
  Desktop Commander ...
---
# AI Tools Setup Assistant
Help users install, configure, and repair AI tooling on their own machine using
Desktop Commander's file and terminal tools. ...

Why it got this result

The skill's golden rules require backing up configs before editing and verifying changes before declaring success; no instruction weakens or bypasses any host confirmation / guardrail. 'Never echo secrets' further reinforces a protective behavior rather than suppressing one.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

4. **Never echo secrets.** ...
5. **Back up before you edit.** Copy the config to a `.bak` first ...
6. **Verify, then stop.** After a change, actually confirm it worked ...

Why it got this result

Golden rule #4 explicitly forbids echoing secrets back in chat and requires redaction in any output/logs/summaries; the skill handles API keys only to the extent of testing validity, never collecting or transmitting them elsewhere.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

4. **Never echo secrets.** API keys, tokens, and passwords go *into the right
   config or `.env` file* — never repeated back in chat. If a user pastes a live
   secret, warn them, use it, and suggest they rotate it if it was shared
   insecurely. Redact secrets in any output, logs, or summaries you produce.

Why it got this result

No capability/permission manifest field exists; the breadth of the described task (installing/configuring third-party AI tooling) is consistent with the stated trigger phrases and does not request scope beyond what the task needs.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers using
  Desktop Commander ...
---

Why it got this result

Scanned SKILL.md and all three references/*.md files for hidden unicode control characters and covert directive phrasing; none found. All instructions are plainly visible and consistent with the stated purpose.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

## Golden rules (read before doing anything)
1. **Detect the OS and shell first.** ...
2. **Verify the model/API key works before you build.** ...

Why it got this result

references/hermes.md and references/openclaw.md provide third-party install commands (curl|bash and npm install) for external tools, not this skill's own shipped runtime launch entry or a self-mutating instruction bundle. The skill package itself contains no updater, live-fetch mechanism, or capability to silently rewrite its own trusted instructions, so the provenance/mutation concern this rule targets is not established by third-party installer prose.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

**CLI only:**

```bash
# Linux / macOS / WSL2 / Android (Termux)
curl -fsSL https://hermes-agent.nousresearch.com/install.sh | bash
```

```bash
# Install
npm install -g openclaw@latest
```

Why it got this result

Skill identifies third-party tools (OpenClaw, Hermes) by their real names and links to their real official docs domains (docs.openclaw.ai, hermes-agent.nousresearch.com) rather than impersonating them; the skill itself is clearly scoped and attributed to Desktop Commander, consistent across all manifests.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

- **OpenClaw** — a self-hosted multi-channel gateway for AI agents. ...
  onboard, wire a model/provider, connect channels (Telegram, Slack, iMessage,
- **Hermes** — disambiguate first: **Hermes Agent** ... vs. **Hermes 3** ...
  → Read [`references/openclaw.md`](references/openclaw.md)

Why it got this result

SKILL.md and its three reference files are plain Markdown instructions/references containing no bundled execution hooks, entry scripts, or format-native execution primitives. The third-party daemon installation they describe is carried out by a model-selected host tool, not a format-native execution mechanism bundled by this skill, so the rule's subject of bundled execution hooks/entry scripts is not established.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Uninstall / cleanup
- Stop the service/daemon, then `npm uninstall -g openclaw`.
- Remove residual files in `~/.openclaw/` (back up first if it holds config the
  user may want).
- Disable any autostart entry created during onboarding.

Why it got this result

SKILL.md frontmatter declares a read-only computer health-check skill that uses Desktop Commander's local shell to gather diagnostics and only performs cleanups the user explicitly approves. The body (safety contract, Steps 1-5) maps 1:1 to that declaration: OS detection, read-only collection via start_process, scoring, chat report, and opt-in cleanup. No undisclosed network egress, credential reads, or exec capability beyond what is declared; explicit text forbids sudo/elevation and states 'Privacy. This reads local system metadata only. Dont send anything off the machine.'

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Run a comprehensive, read-only health check on the user's computer...
  scored chat summary with prioritized, plain-English recommendations and safe cleanup
  suggestions. Use this whenever the user wants to check their computer's health, speed
  it up, free up / reclaim disk space, find what's eating CPU / memory / storage, check
  battery health and wear, audit login & startup items, see pending updates, or asks for
...
  healthy". Trigger even on casual phrasing like "my laptop feels slow", "why is my fan
  so loud", "my computer is laggy", "running out of space", or "clean up my machine".
  Works on macOS, Windows, and Linux. This is a Desktop Commander skill: it relies on a
  real local shell (start_process / interact_with_process) and is strictly read-only by
  default — it never needs sudo and only performs cleanups the user explicitly approves.

Why it got this result

Instruction body explicitly REQUIRES user consent before any state-changing action: 'Cleanups are opt-in. You may suggest cleanups freely, but only execute one after the user explicitly approves that specific action, and only show the exact command first.' No prose instructs the agent to skip confirmation, hide actions, or claim pre-authorization; brevity guidance ('Keep it tight and scannable') only shapes report formatting, not concealment of privileged actions.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

### Step 5 — Suggest cleanups, execute only on approval

For each recommendation that maps to a concrete command (see the reference file's "Cleanup"
section), offer it and show the exact command. Then:
  cache cleanup...
- **Safe, reversible** (offer to run on a yes): empty Trash, package-manager cache cleanup
  login items, installing OS updates...
  `apt-get clean` / `dnf clean` need root — suggest, don't auto-run.)
- **Needs the user to decide / act** (suggest, don't auto-run): disabling login items,
  installing OS updates (requires restart), uninstalling apps, deleting files in Downloads.

Why it got this result

SKILL.md frontmatter declares no allowed-tools/scope/permissions field at all (no wildcard grant, no OAuth/permission block) and ships no bundled executable, package.json bin/postinstall, or code-executing lifecycle hook -- a purely declarative text artifact. The prose explicitly narrows its OWN use of the host's broader tool surface to read-only diagnostics plus opt-in, confirmed cleanups, and explicitly forbids sudo/elevation -- i.e. it self-restricts below what the host grants rather than requesting anything beyond its stated purpose.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

## The safety contract (read this first)

This is the part that makes users trust the skill, so honor it strictly:

- **Read-only by default.** The collection phase only *observes* (sizes, counts, status).

Why it got this result

Codepoint scan of SKILL.md for zero-width/bidi/Tag-block characters, mixed-script confusables, forged chat-template tokens, HTML comments, and ANSI escapes found none. The raw bytes are byte-identical to the rendered content; all instruction text is purely descriptive with no host-directed imperatives hidden from a reviewer.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(codepoint scan: no U+200B/200C/200D/2060/FEFF, no U+202A-202E/2066-2069 bidi overrides, no HTML comments, no forged chat-template tokens, no ANSI escapes found in this file)

Why it got this result

SKILL.md and its reference files ship fully inside the bundle as static markdown -- no runtime fetch of instructions from a mutable endpoint, no self-rewriting install hook, and this component itself ships no MCP server launch entry (that lives one directory up in the parent plugin manifest, evaluated under the root component).

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent
description: >-
  Run a comprehensive, read-only health check...

Why it got this result

Name 'computer-health-check' is a plain descriptive name with no near-miss edit-distance to any known brand/tool, no homoglyph/leetspeak substitution, no trust-implying prefix (official-/verified-), no version/tier-spoofing suffix, and no prose claiming to be an official/updated/drop-in replacement for a named legitimate tool. Published by wonderwhy-er (the genuine Desktop Commander project owner, confirmed via git remote origin).

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent

Why it got this result

No instruction text reads host credential stores (env secrets, ~/.ssh, ~/.aws, keychain) or the model's conversation/system-prompt context. Per the rule's SCOPE guidance, the harvest half governs applicability: this skill only reads local system diagnostics (disk/memory/battery/process state) and explicitly states 'Privacy. This reads local system metadata only. Don't send anything off the machine.' With no harvest step constructible, no harvest+exfil pair exists, so the rule's subject does not exist in this component.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- **Privacy.** This reads local system metadata only. Don't send anything off the machine;
  the public-IP check is optional and should be labeled.

Why it got this result

This component ships only SKILL.md and three reference markdown files -- no bundled scripts, lifecycle/event hooks, entry-point code, dotenv/git-hook files, or env-var assignments. Per the rule's SCOPE paragraph, since the bundle ships none of the format-native execution/control-plane primitives the rule enumerates, there is no OOB-execution surface to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent
description: >-
  Run a comprehensive, read-only health check...

Why it got this result

Pure documentation describing Desktop Commander's existing MCP tools and maps 1:1 to the declared frontmatter description. No bundled code, no hidden network egress, no undisclosed credential reads.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
---

# Desktop Commander MCP

Desktop Commander gives the agent reach across the user's actual computer...

Why it got this result

A YARA signature (agentic_metadata:Zeus_Metadata_Consent_Suppression, cluster L20-L84) flagged this file. The scanner_attestation object was not available in this session. Manually reading the full cluster L20-L84 shows the opposite of suppression: the text explicitly instructs the agent to GET user confirmation before risky actions ('explain the intended action and get user confirmation when the risk is non-trivial'; 'summarize the action and confirm with the user unless they already explicitly asked for that exact operation'). There is no 'do not tell the user', 'auto-approve', or authority-override language anywhere in the file. This is assessed as a false positive on the signature's part -- the keyword proximity of 'confirm'/'user'/'explicitly' near each other matched the pattern but the semantic content reinforces consent rather than suppressing it.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

### "Debug this production issue"

Before running production-impacting SSH commands, explain the intended action and get user confirmation when the risk is non-trivial.
...
### "Deploy this to staging"

Before deploys, restarts, migrations, or other environment-changing commands, summarize the action and confirm with the user unless they already explicitly asked for that exact operation.

Why it got this result

SKILL.md lines 82-84 retrieve prior tool arguments and outputs, which is a conversation-context read this rule evaluates. The read remains in-session, with no instruction to transmit or exfiltrate that context outward, so the harvest-and-exfiltration pattern this rule targets is not present.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

(full file reviewed: content only describes Desktop Commander's shell/file/search/SSH tools and example workflows; no credential-store read or conversation-context dump instruction present)

Why it got this result

SKILL.md frontmatter declares no allowed-tools/permissions field at all (verified: grep for allowed-tools/permissions/scope across this file returns nothing) -- there is no wildcard or catch-all declared scope to flag.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
version: 0.1.0
audience: agent
---

Why it got this result

Codepoint scan found no zero-width/bidi/Tag-block characters and no forged chat-template tokens or homoglyph substitutions in this SKILL.md.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(full file codepoint-scanned: 7-bit-clean ASCII prose aside from standard em-dashes/emoji; no concealment codepoints, no forged system/role tokens)

Why it got this result

Name 'desktop-commander-overview' is a plain descriptive name for a documentation skill about the repo's own Desktop Commander product, not a near-miss of any other brand.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...

Why it got this result

This component is a single SKILL.md with no bundled script, lifecycle hook, dotenv, git hook, or env-var assignment of any kind. It only instructs the model to call already-registered host tools through the normal consent-gated flow, which is explicitly not a format-native primitive per this rule.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
version: 0.1.0
audience: agent
---

Why it got this result

This component is a single static SKILL.md shipped inline in the repo -- it has no launch entry of its own, no runtime instruction fetch, and no self-update mechanism. The launch-pinning concern belongs to the plugin.json manifest (evaluated under the plugins/claude component), not to this skill file.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
version: 0.1.0
---

Why it got this result

Declared purpose ('Create and maintain a Markdown knowledge base') matches the entire body, which only covers note/index conventions and file read/write/search workflows via Desktop Commander tools. No undeclared capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: knowledge-base
...
description: >-
  Create and maintain a Markdown knowledge base that any AI agent can read,
  search, and update. ...
---
# Knowledge Base (Markdown, agent-readable)

Why it got this result

Maintenance workflows do merge and archive notes, but the instructions require reporting these changes to the user and require clarification for ambiguous requests, so there is no language suppressing consent or concealing actions from the user.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Workflows
### Create a new KB
1. `create_directory` for the folder structure above.
2. `write_file` `INDEX.md` with the instructions block ...

Why it got this result

No capability/permission manifest field; scope (markdown file CRUD) matches the stated purpose with no broader access requested.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base ...
---

Why it got this result

No hidden unicode control characters or covert directives found in the file.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: knowledge-base
...
---
# Knowledge Base (Markdown, agent-readable)

Why it got this result

This skill contains no package install, launch config, or external-code-execution instructions of any kind — purely local markdown file management.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: knowledge-base
...
---
# Knowledge Base (Markdown, agent-readable)

Why it got this result

Generic skill name with no reference to any third-party brand to impersonate; consistent with the Desktop Commander plugin bundle's own identity.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: knowledge-base
...
---
# Knowledge Base (Markdown, agent-readable)

Why it got this result

The skill only reads and writes user-authored Markdown notes; it contains no mechanism that reads host credentials, API keys, or live conversation or memory context, so the rule's subject matter is absent rather than present-and-secure.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

---
name: knowledge-base
...
description: >-
  Create and maintain a Markdown knowledge base that any AI agent can read,
  search, and update. ...

Why it got this result

The skill is prose-only and invokes only disclosed KB index-writing operations through existing tools; it ships no format-native execution or host control-plane persistence primitive, placing it outside the rule's subject matter.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Workflows
### Create a new KB
1. `create_directory` for the folder structure above.
2. `write_file` `INDEX.md` ...

Why it got this result

SKILL.md declares an Obsidian vault-organizing skill (MOCs, wikilinks, frontmatter, dashboards). Body content (wikilinks, MOCs, frontmatter rules, dashboards, orphan detection, folder organization, dedup/rename workflows) matches the declared scope exactly, using only read_file/write_file/edit_block/start_search file operations on vault content -- no network egress, no credential reads, no undeclared exec capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties,
  dashboards, orphan-note checks, and cleanup workflows. Use ONLY when the user
  user explicitly refers to Obsidian...
  an Obsidian-specific feature such as wikilinks ("[[ ]]"), the Dataview or Bases
  plugins, or Obsidian Properties. Within that Obsidian context it covers
  creating Maps of Content, adding/fixing wikilinks, finding orphan notes,
  normalizing YAML frontmatter, generating Dataview/Bases dashboards, organizing

Why it got this result

No imperative prose suppresses confirmation, hides privileged actions, or asserts override authority over the host/user. Destructive-adjacent actions (deletes during dedup) are described as 'copy unique content... then repoint before deleting it' as part of the declared workflow, not concealed from the user; the skill instead defers renames/moves to the user acting inside Obsidian itself.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Deduplicate & rename

- **Duplicates**: `start_search` titles/aliases to find near-identical notes;
  merge into one, keep the most-linked filename, copy unique content with
  `edit_block`, then `start_search` for inbound `[[links]]` to the discarded note
  and repoint them before deleting it.
- **Renames**: do them inside Obsidian (Rename note / `F2`) so backlinks update —

Why it got this result

No allowed-tools/scope/permissions field in frontmatter, no wildcard grant, no bundled executable or install hook. The described capability (reading/editing local vault note files) matches the stated purpose exactly with no requested reach into shell/network/credential territory.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties,
  dashboards, orphan-note checks, and cleanup workflows...

Why it got this result

Codepoint scan found no concealment codepoints, forged tokens, HTML comments, or ANSI escapes. Content is purely descriptive guidance for Obsidian vault organization.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(codepoint scan: no concealment codepoints, no HTML comments, no forged chat-template tokens found in this file)

Why it got this result

SKILL.md ships fully inside the bundle; no runtime instruction fetch, no self-mutation, no launch entry owned by this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks...

Why it got this result

Name 'obsidian-vault' plainly describes its function and is not a near-miss/homoglyph of a brand name; the skill does not claim to BE Obsidian or impersonate the Obsidian publisher -- it explicitly scopes itself to assisting users who already use Obsidian ('Use ONLY when the user explicitly refers to Obsidian'). No trust-implying prefix, version-spoofing suffix, or fork/official claim.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties...
  Use ONLY when the user explicitly refers to Obsidian...

Why it got this result

No instruction text reads host credential stores or model conversation/system-prompt context; the skill only reads/writes vault note files. No harvest step exists, so no harvest+exfil pair is constructible.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties,
  dashboards, orphan-note checks, and cleanup workflows...

Why it got this result

This component ships only a single SKILL.md -- no bundled scripts, hooks, dotenv, or env assignments. No format-native execution/control-plane primitive exists to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks...

Why it got this result

Terminal skill's declared purpose (shell/terminal assistance via Desktop Commander) matches actual prose content exactly. No undisclosed capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: terminal
description: Use Desktop Commander for terminal and command-line work... Never run destructive commands without explicit confirmation.
audience: agent

Why it got this result

No bundled hook/settings file or prose instructs the agent to bypass confirmation. All bundled skills explicitly REQUIRE confirmation before state-changing actions (terminal, ai-tools-setup, computer-health-check all gate destructive/approve-worthy actions on explicit user yes). No 'do not tell the user' / 'auto-approve' / 'proceed without confirmation' language anywhere in the bundle.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Beyond that list, treat these as **destructive -- never run without the user's
explicit confirmation**, even if they'd technically succeed:
...
For these: show the exact command, explain in one line what it will irreversibly
do, and wait for a clear "yes".

## 7. Safety: destructive commands and chaining

Desktop Commander already refuses a built-in `blockedCommands` list...
`sudo`, `mkfs`, `format`, `dd`, `fdisk`, `shutdown`, `reboot`, `diskpart`,
explicit confirmation**...

- **Cleanups are opt-in.** You may *suggest* cleanups freely, but only *execute* one after
  the user explicitly approves that specific action, and only show the exact command first.

Why it got this result

No allowed-tools/permissions frontmatter field declared; nothing to flag as over-broad.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: terminal
version: 0.1.0
audience: agent
description: >-
  Use Desktop Commander for terminal and command-line work...
---

Why it got this result

Codepoint scan found no concealment characters or forged chat-template tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(full file codepoint-scanned: no concealment codepoints or forged tokens found)

Why it got this result

Generic name 'terminal' with no brand resemblance or impersonation prose.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: terminal
version: 0.1.0
audience: agent

Why it got this result

No instruction directs reading credential stores or conversation context; the skill only advises NOT to echo secrets into terminal output. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Operating etiquette

- Preview risky commands before running; run read-only inspection first.
- Use absolute paths; respect `allowedDirectories`.
- Never print secrets, tokens, or passwords into output; redact if they appear.

Why it got this result

Single SKILL.md, no bundled scripts/hooks/env assignments; only directs the model to call already-registered host tools.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: terminal
version: 0.1.0
audience: agent
description: >-
  Use Desktop Commander for terminal and command-line work...
---

Why it got this result

Static, bundled SKILL.md with no launch entry, no runtime fetch, no self-update mechanism of its own.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: terminal
version: 0.1.0
audience: agent
---

Why it got this result

SKILL.md declares a skill to install/configure/validate Claude Desktop, MCP servers, OpenClaw, and Hermes using Desktop Commander's file/terminal tools. The body and the three reference files (claude-desktop-mcp.md, openclaw.md, hermes.md) describe exactly that: reading/editing config files, starting local processes, verifying installs. All network calls (npm install of named third-party packages, curl install scripts documented upstream) are disclosed, functionally tied to the stated install/configure purpose, and no credential exfiltration or hidden exec capability is present -- the skill explicitly instructs never to echo secrets.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers using
  Desktop Commander... Use when a user wants to install, configure, connect,
  getting MCP servers to connect, and diagnosing local AI tooling. Use when a
  user wants to install, configure, connect, validate, or fix Claude Desktop, an
  MCP server, an MCP config file, or a local AI agent/gateway. Trigger on the
  symptoms that actually bring people in: "Claude can't see my tools", "my MCP
  server isn't showing up", "tools aren't loading in Claude", "add an MCP

Why it got this result

Body includes explicit transparency/disclosure rules rather than suppression: 'Translate errors, don't dump them' (formatting, not concealment of a privileged action), 'Never echo secrets... Redact secrets in any output, logs, or summaries you produce' (protects secrets from leaking, does not hide a state-changing action from the user), and 'Verify, then stop... Don't declare success on a guess.' No directive tells the agent to bypass confirmation or hide an action from the user.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

3. **Translate errors, don't dump them.** When a tool returns a raw JSON/HTTP
   error, explain in one line what it means...
   missing, deprecated, rate-limited, or doesn't support tool-calling, suggest a
   config or .env file* — never repeated back in chat...
5. **Back up before you edit.** Copy the config to a .bak first...
6. **Verify, then stop.** After a change, actually confirm it worked...

Why it got this result

Credential handling here is applicable, not out of scope: the skill directs use of a user's already-configured provider API key for a single same-provider validation call, with explicit instructions never to echo or log the secret. The validation call and the key stay within the same provider relationship, so there is no third-party harvest-and-exfiltration pair, and the handling practices -- redaction and same-provider routing -- qualify as safe use of the credential.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

2. **Verify the model/API key works before you build.** The most common reason
   these sessions dead-end is a provider auth or billing error discovered
   *after* a lot of setup work. Make one tiny test call with `start_process` (a quick
   curl to the provider) early, and tell the user plainly if the key is invalid
   or out of credit.

Why it got this result

No allowed-tools/scope/permissions field, no wildcard, no bundled executable or install-lifecycle hook. The skill's use of shell/process tools (start_process for curl test calls, config edits) is intrinsic and proportionate to its declared purpose of installing/configuring/repairing local AI tooling.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers...

Why it got this result

Codepoint scan of SKILL.md and its three reference files found no concealment codepoints, forged chat-template tokens, HTML comments, or ANSI escapes. All content is descriptive setup/troubleshooting guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(codepoint scan: no concealment codepoints, no forged chat-template tokens, no HTML comments found in this file)

Why it got this result

SKILL.md and its reference files ship fully inside the bundle; no runtime fetch of the skill's own instructions, no self-mutation, no launch entry owned by this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers...

Why it got this result

Name 'ai-tools-setup' is generic/descriptive, not a near-miss of any specific brand. Reference docs name real third-party tools (Claude Desktop, OpenClaw, Hermes) accurately and link to their genuine official docs (docs.openclaw.ai, hermes-agent.nousresearch.com) rather than impersonating them or pointing at look-alike domains; install commands target the real published packages (npm install -g openclaw, the official Hermes installer URL).

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

- **OpenClaw** — a self-hosted multi-channel gateway for AI agents...
  → Read `references/openclaw.md`
- **Hermes** — disambiguate first: **Hermes Agent** (the Nous Research
  self-improving agent framework)...

Why it got this result

This component ships only SKILL.md plus three reference markdown files (install documentation) -- no lifecycle hooks, entry-point code, dotenv/git-hooks, or exec-enabling / endpoint-substituting env assignments shipped by the skill itself. The documented third-party install commands (npm install -g openclaw, curl install.sh | bash) are install instructions for SEPARATE external tools the user runs manually, not a format-native primitive this artifact itself ships or auto-executes.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers...

Why it got this result

Declared purpose is a read-only health check; actual content (collection scripts in references/*.md) are exclusively read-only diagnostics (df, ps, vm_stat, pmset, etc.) with cleanup commands gated on explicit user approval. No undisclosed network egress or credential access.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Run a comprehensive, read-only health check on the user's computer...
  it never needs sudo and only performs cleanups the user explicitly approves.
---

zsh -c '
echo "== SYSTEM =="; sw_vers; echo "uptime:"; uptime
...
echo "== DONE =="'

Why it got this result

The 'safety contract' section explicitly requires opt-in consent for every cleanup action ('only *execute* one after the user explicitly approves that specific action'). No disclosure-suppression or auto-approve language.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## The safety contract (read this first)
...
- **Cleanups are opt-in.** You may *suggest* cleanups freely, but only *execute* one after
  the user explicitly approves that specific action, and only show the exact command first.

Why it got this result

No declared allowed-tools/permissions scope in frontmatter; the skill is explicitly scoped to read-only diagnostics with opt-in cleanup, matching its stated purpose with no broader grant.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent
description: >-
  Run a comprehensive, read-only health check...
---

Why it got this result

Codepoint scan of SKILL.md and all 3 references/*.md found no concealment characters or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(full file + references/{macos,windows,linux}.md codepoint-scanned: no concealment codepoints or forged tokens found)

Why it got this result

Generic descriptive name 'computer-health-check', no brand resemblance or impersonation claims.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent

Why it got this result

The skill reads only local system metadata (disk, memory, battery, startup items), never credential stores or conversation context, and explicitly states nothing is sent off the machine. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- **Privacy.** This reads local system metadata only. Don't send anything off the machine;
  the public-IP check is optional and should be labeled.

Why it got this result

Only SKILL.md + references/*.md reference docs; the inline shell diagnostics are run through start_process (the host's normal post-decision tool invocation), not at load time, and no lifecycle hook or env-hijack exists.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Collection script (run as one batched process)

Run this with `start_process` (timeout ~30s). It prints labeled sections you can parse.

Why it got this result

Static, bundled SKILL.md + reference docs; no launch entry of its own (the plugins/cursor plugin manifest that carries the npx launch line is a sibling directory not part of this component's path and is outside the 7 components in scope for this scan).

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent
---

Why it got this result

SKILL.md declares a Markdown knowledge-base creation/maintenance skill. Body content (index-first navigation, atomic notes, frontmatter schema, workflows using create_directory/write_file/edit_block/start_search) matches the declared scope exactly -- purely local file organization with no network egress, credential access, or undisclosed exec capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Create and maintain a Markdown knowledge base that any AI agent can read,
  search, and update...
  update notes, organize docs/notes for an agent or LLM to consume, build an
  index of notes, or run a cleanup/maintenance pass on an existing MD knowledge
agent can navigate it without a vector database...

Why it got this result

No prose instructs the agent to skip confirmation, hide privileged steps, or assert authority over host/user policy. All file creates/edits are described as direct declared actions of the skill's core function (writing notes/index), not actions concealed from the user.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Workflows

### Create a new KB
- **Normalize metadata**: read_multiple_files to audit properties...
2. `write_file` `INDEX.md` with the instructions block, an empty controlled-tag
   list, and an empty registry.

Why it got this result

No allowed-tools/scope/permissions field, no wildcard, no bundled executable or install hook. Declared capability (local Markdown file organization) matches stated purpose exactly.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base...

Why it got this result

One HTML comment exists ('<!-- extend deliberately -->') but it sits inside an illustrative fenced code-block example of a controlled-tag list, is purely a human-readable annotation with no host-directed imperative, and is not concealed from the rendered view (it is a normal visible markdown comment in example text, not a raw-vs-rendered mismatch). No zero-width/bidi codepoints, forged chat-template tokens, or ANSI escapes found.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

## Controlled tags
`auth`, `security`, `billing`, `api`, `ops`   <!-- extend deliberately -->

Why it got this result

SKILL.md ships fully inside the bundle; no runtime instruction fetch, no self-mutation, no launch entry owned by this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base...

Why it got this result

Name 'knowledge-base' is a generic common term, not a near-miss of any specific branded product. No trust-implying prefix, version-spoofing suffix, or impersonation prose.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent

Why it got this result

No instruction text reads host credential stores or model conversation/system-prompt context; the skill only reads/writes local Markdown note files with no outbound channel at all. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

description: >-
  Create and maintain a Markdown knowledge base that any AI agent can read,
  search, and update...

Why it got this result

This component ships only a single SKILL.md -- no bundled scripts, hooks, dotenv, or env assignments. No format-native execution/control-plane primitive exists to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base...

Why it got this result

Declared purpose (Obsidian vault organization) matches actual prose content exactly; only file read/edit ops via Desktop Commander's already-declared tools, scoped to the user's vault.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties,
  dashboards, orphan-note checks, and cleanup workflows. Use ONLY when the user
  explicitly refers to Obsidian...

Why it got this result

The skill's workflow includes state-changing edits and deduplication of vault notes, not merely passive organizational guidance. It remains SECURE because no instruction suppresses confirmation, hides changes, or directs the host to bypass approval before acting.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

(full file reviewed: no imperative directs the host to skip confirmation, hide an action from the user, or assert authority over host instructions)

Why it got this result

No declared allowed-tools/permissions scope; narrow documented purpose (Obsidian vault organization).

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks...
---

Why it got this result

Codepoint scan found no concealment characters or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(full file codepoint-scanned: no concealment codepoints or forged tokens found)

Why it got this result

Name 'obsidian-vault' legitimately refers to the real Obsidian product as a compatibility descriptor (a vault-organizing helper that triggers only when the user explicitly says 'Obsidian'), not a claim to BE Obsidian or an official Obsidian extension -- no impersonation prose, no trust-implying prefix, no version-spoofing suffix, and no install-instruction that replaces or spoofs the real Obsidian distribution channel.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: obsidian-vault
description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties,
  dashboards, orphan-note checks, and cleanup workflows. Use ONLY when the user
  explicitly refers to Obsidian...
---

Why it got this result

The skill only reads/edits the user's Obsidian vault notes; no credential store or conversation-context read, no outbound channel. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

(full file reviewed: no credential-store or conversation-context read instruction anywhere)

Why it got this result

Single SKILL.md with no bundled executable, hook, or env assignment.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks...
---

Why it got this result

Static, bundled SKILL.md; no launch entry of its own.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
---

Why it got this result

Byte-identical in substance to plugins/cursor/skills/ai-tools-setup (only a markdown link-syntax difference). Same analysis applies: declared install/configure-AI-tooling purpose matches actual instruction content with no undisclosed network/credential/exec capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers using
  Desktop Commander — inspecting and fixing mcp.json / claude_desktop_config.json,
  getting MCP servers to connect, and diagnosing local AI tooling.

Why it got this result

Same content as plugins/cursor/skills/ai-tools-setup (only markdown link-syntax differs); same analysis: no consent-suppression or oversight-override prose present.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

4. **Never echo secrets.** API keys, tokens, and passwords go *into the right
   config or `.env` file* — never repeated back in chat. If a user pastes a live
   live secret, warn them, use it, and suggest they rotate it...
5. **Back up before you edit.** Copy the config to a `.bak` first...

Why it got this result

The skill instructs a brief provider test call using the user's own supplied API key to confirm it works and has credit, which is a user-supplied credential read within this rule's scope. No credential-store harvesting occurs and no third-party exfiltration channel is instructed; the key is used only within the user's own existing provider relationship.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

2. **Verify the model/API key works before you build.** ... Make one tiny test
   call with `start_process` (a quick curl to the provider) early, and tell
   the user plainly if the key is invalid or out of credit.

Why it got this result

Same manifest/content as plugins/cursor/skills/ai-tools-setup; no wildcard/scope grant, no bundled executable or install hook; capability matches declared purpose.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers...

Why it got this result

Same content as plugins/cursor/skills/ai-tools-setup; codepoint scan found no concealment codepoints, forged tokens, HTML comments, or ANSI escapes.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(codepoint scan: no concealment codepoints, no forged chat-template tokens, no HTML comments found in this file)

Why it got this result

Same as plugins/cursor/skills/ai-tools-setup: ships fully inside the bundle, no runtime fetch, no self-mutation, no launch entry owned by this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers...

Why it got this result

Identical to plugins/cursor/skills/ai-tools-setup: generic name, accurate references to real third-party tools with genuine official links/install commands, no impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent

Why it got this result

Same as plugins/cursor/skills/ai-tools-setup: no bundled scripts/hooks/dotenv/env assignments shipped by this skill; documented third-party install commands are manual instructions, not an auto-executed primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: ai-tools-setup
version: 0.1.0
audience: agent
description: >-
  Set up, connect, validate, and repair Claude Desktop and MCP servers...

Why it got this result

Identical content to plugins/cursor and plugins/claude variants -- read-only diagnostics matching declared purpose, cleanup gated on consent.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Run a comprehensive, read-only health check on the user's computer...
  it never needs sudo and only performs cleanups the user explicitly approves.
---

Why it got this result

Same safety contract as plugins/cursor variant: explicit opt-in approval required for every cleanup action.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## The safety contract (read this first)
...
- **Cleanups are opt-in.** You may *suggest* cleanups freely, but only *execute* one after
  the user explicitly approves that specific action...

Why it got this result

No declared allowed-tools/permissions scope; scoped to read-only diagnostics matching purpose.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent
description: >-
  Run a comprehensive, read-only health check...
---

Why it got this result

Codepoint scan of SKILL.md and all 3 references/*.md found no concealment characters or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(full file + references/{macos,windows,linux}.md codepoint-scanned: no concealment codepoints or forged tokens found)

Why it got this result

Generic descriptive name, no brand resemblance.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent

Why it got this result

Identical content to the plugins/cursor variant: reads only local system metadata, explicitly no off-machine sends. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- **Privacy.** This reads local system metadata only. Don't send anything off the machine;
  the public-IP check is optional and should be labeled.

Why it got this result

Same as the plugins/cursor variant: diagnostics run via start_process (post-decision tool call), no lifecycle hook/env-hijack present.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Collection script (run as one batched process)

Run this with `start_process` (timeout ~30s). It prints labeled sections you can parse.

Why it got this result

Static, bundled SKILL.md + reference docs at repo root skills/ directory; no launch entry, no runtime fetch.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: computer-health-check
version: 0.1.0
audience: agent
---

Why it got this result

Body content (workflow examples, tool inventory, conventions) is a straightforward elaboration of the declared description; no capability outside the stated MCP tool-usage guidance.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
---
# Desktop Commander MCP
Desktop Commander gives the agent reach across the user's actual computer ...

Why it got this result

The workflow examples repeatedly instruct the agent to seek confirmation before risky actions ('Before running production-impacting SSH commands, explain the intended action and get user confirmation when the risk is non-trivial', 'Before deploys, restarts, migrations... summarize the action and confirm with the user', 'Preview the move plan before executing destructive ops'). This reinforces human-in-the-loop gates rather than weakening, skipping, or socially engineering around them. No instruction anywhere tells the agent to proceed without confirmation, hide an action from the user, or bypass a host guardrail.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

### "Debug this production issue"

Before running production-impacting SSH commands, explain the intended action and get user confirmation when the risk is non-trivial.

`start_process("ssh [REDACTED]", timeout_ms=...)` opens a long-lived SSH session ...

### "Deploy this to staging"

Before deploys, restarts, migrations, or other environment-changing commands, summarize the action and confirm with the user unless they already explicitly asked for that exact operation.

Why it got this result

SKILL.md lines 82-84 use get_recent_tool_calls to retrieve recent tool-call arguments and outputs, so this rule is applicable to that behavior. The retrieved history remains in-session and no instruction pairs it with an outbound channel such as SSH or another network sink to export credentials or conversation context, so no exfiltration occurs.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Core tool inventory
- **Process / shell:** `start_process`, `interact_with_process`, `read_process_output`, `list_processes`, `list_sessions`, `kill_process`, `force_terminate`
- **Files (read/write):** `read_file`, `read_multiple_files`, `write_file`, `edit_block`, `write_pdf`

Why it got this result

The SKILL.md frontmatter has no capability/permission manifest fields (name/description/version/audience only) — there is nothing to over-declare. The body's described capability breadth (filesystem, process, search) matches exactly the MCP tools it documents and is gated by the MCP server's own allowedDirectories/blockedCommands configuration, not by anything this skill grants itself.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
version: 0.1.0
audience: agent
---

Why it got this result

Programmatic scan of the full file for zero-width/bidi control characters (U+200B, U+200C, U+200D, U+202A, U+202E, U+2066, U+2069, U+FEFF) found none. Manual read of the full text found only plain-language workflow guidance, no hidden directives, ANSI escapes, or 'ignore previous instructions'-style covert text.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities — persistent shells and REPLs, long-running processes, filesystem beyond the workspace, structured files (.xlsx, .docx, .pdf, images) and large local data files such as CSVs, ripgrep search at scale, SSH, or cross-turn state.
version: 0.1.0
audience: agent
---

Why it got this result

This skill directory ships only a SKILL.md with no launch configuration or package-install instructions of its own; it references the MCP's tools by name only. The repo-level unpinned-launch concern (root .mcp.json) is evaluated separately against the mcp-server and plugins/cursor components that actually ship that manifest.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

## Core tool inventory
Grouped index of the tools an agent reaches for most often. ...

Why it got this result

Skill name/branding ('desktop-commander-overview') matches the project's own product name consistently with package.json (@wonderwhy-er/desktop-commander), the repo README, and all plugin manifests (publisher 'Desktop Commander', homepage desktopcommander.app, repo wonderwhy-er/DesktopCommanderMCP). No typosquatting of a third-party name or spoofed publisher identity.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: desktop-commander-overview
description: Use for Desktop Commander MCP capabilities ...
---

Why it got this result

This skill ships only a SKILL.md file; its persistent shell sessions are ordinary composed tool calls, not format-native out-of-band execution, entry-point hooks, or durable control-plane persistence mechanisms, so the subject matter of this rule is not present here.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

## Example workflows
Each example names the actual tool sequence. ...

Why it got this result

Identical to plugins/cursor/skills/knowledge-base (diff -rq confirms byte-identical directory contents). Declared knowledge-base maintenance purpose matches actual content with no undisclosed capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Create and maintain a Markdown knowledge base that any AI agent can read,
  search, and update. Use when the user wants to start a knowledge base...

Why it got this result

Identical content to plugins/cursor/skills/knowledge-base; no consent-suppression prose present.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Workflows

### Create a new KB
- **Normalize metadata**: `read_multiple_files` to audit properties...

Why it got this result

Identical to plugins/cursor/skills/knowledge-base; no wildcard/scope grant, no bundled executable or install hook; capability matches declared purpose.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base...

Why it got this result

Identical to plugins/cursor/skills/knowledge-base: the one HTML comment present is a benign, visible example annotation ('<!-- extend deliberately -->') inside a fenced controlled-tag-list example, not a concealed directive. No concealment codepoints, forged tokens, or ANSI escapes found.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

## Controlled tags
`auth`, `security`, `billing`, `api`, `ops`   <!-- extend deliberately -->

Why it got this result

Identical to plugins/cursor/skills/knowledge-base: ships fully inside the bundle, no runtime fetch, no self-mutation, no launch entry owned by this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base...

Why it got this result

Identical to plugins/cursor/skills/knowledge-base: generic name, no impersonation.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent

Why it got this result

No instruction text reads host credential stores or conversation/system-prompt context; purely local note-file organization with no outbound channel. No harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

description: >-
  Create and maintain a Markdown knowledge base that any AI agent can read,
  search, and update...

Why it got this result

This component ships only a single SKILL.md -- no bundled scripts, hooks, dotenv, or env assignments. No format-native execution/control-plane primitive exists to evaluate.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: knowledge-base
version: 0.1.0
audience: agent
description: >-
  Create and maintain a Markdown knowledge base...

Why it got this result

Declared purpose matches actual content -- Obsidian vault organization workflows only, no undisclosed capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties...

Why it got this result

Purely organizational guidance; no confirmation flow to suppress and no authority-override prose.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

(full file reviewed: no imperative directs the host to skip confirmation, hide an action from the user, or assert authority over host instructions)

Why it got this result

No declared allowed-tools/permissions scope; narrow documented purpose.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks...
---

Why it got this result

Codepoint scan found no concealment characters or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

(full file codepoint-scanned: no concealment codepoints or forged tokens found)

Why it got this result

The skill consists solely of a bundled SKILL.md describing the model-facing instruction trust surface, with no live-fetch of instructions, launcher, or self-mutation capability present in the file, consistent with a declarative artifact that does not fetch or mutate its own instructions.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
---

Why it got this result

Same as plugins/cursor variant: legitimate compatibility descriptor for the real Obsidian product, no impersonation claim or spoofed install channel.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: obsidian-vault
description: >-
  Organize Obsidian vaults with MOCs, wikilinks, frontmatter/properties...
---

Why it got this result

Only reads/edits the user's Obsidian vault notes; no credential or conversation-context harvest, no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

(full file reviewed: no credential-store or conversation-context read instruction anywhere)

Why it got this result

Single SKILL.md with no bundled executable, hook, or env assignment.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: obsidian-vault
version: 0.1.0
audience: agent
description: >-
  Organize Obsidian vaults with MOCs, wikilinks...
---

Why it got this result

Body is a terminal-usage guide consistent with the declared description; no undeclared capability (e.g. no hidden network exfil or persistence instructions).

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: terminal
...
description: >-
  Use Desktop Commander for terminal and command-line work ...
---
# Terminal Command Assistant

Why it got this result

Section 7 ('Safety: destructive commands and chaining') explicitly instructs the agent to treat a long list of operations as 'destructive — never run without the user's explicit confirmation', to show the exact command and wait for a clear 'yes', and to avoid chaining a destructive step so a failure can't cascade past confirmation. No suppression language found.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## 7. Safety: destructive commands and chaining

Desktop Commander already refuses a built-in `blockedCommands` list ...

Beyond that list, treat these as **destructive — never run without the user's
explicit confirmation**, even if they'd technically succeed:
...
For these: show the exact command, explain in one line what it will irreversibly
do, and wait for a clear "yes".

Why it got this result

No permission/capability manifest field exists in frontmatter; scope described in the body (terminal command usage) matches the declared description exactly.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: terminal
version: 0.1.0
audience: agent
description: >-
  Use Desktop Commander for terminal and command-line work ...
---

Why it got this result

Programmatic scan for hidden/bidi unicode control characters found none; no concealed directives in the visible text.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: terminal
...
description: >-
  Use Desktop Commander for terminal and command-line work ...
---

Why it got this result

The skill mentions npm/pnpm/yarn installs in its prose, but these are ordinary user-requested terminal tasks rather than a self-owned launch entry or instruction-update mechanism. The skill ships no updater or self-mutation capability, so it remains free of rug-pull risk.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: terminal
...
---
# Terminal Command Assistant

Why it got this result

Generic, accurately-scoped skill name ('terminal') consistent with the project's own branding; no impersonation of a third-party product.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: terminal
...
---
# Terminal Command Assistant

Why it got this result

The skill's secret redaction warnings and generic cloud CLI guidance do not direct or implement raw credential-store reads, conversation-context dumps, or memory routing; the environment inspection shown is limited to non-secret config, systemInfo, and HOME examples. The harvest-and-exfiltrate scope this rule targets does not apply here.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Operating etiquette
- Preview risky commands before running; run read-only inspection first.
- Use absolute paths; respect `allowedDirectories`.
- Never print secrets, tokens, or passwords into output; redact if they appear.

Why it got this result

Only SKILL.md is bundled, with no native loader, hook, dotenv, or persistent host-instruction write shipped by the skill itself. The curl-to-shell passage warns the agent to confirm before piping remote content into a shell rather than directing shipped out-of-band execution; script creation is user-requested and disclosed. This rule's subject does not apply to this bundle.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

- **curl / HTTP**: fine for inspection (`curl -i https://...`). Be careful with
  anything that pipes a downloaded script straight into a shell
  (`curl ... | sh`) — that's untrusted code execution; show it and confirm first.