╭─────────────────────────────────── xrails ───────────────────────────────────╮
│ xrails scan — /tmp/skill                                                     │
│ Profiles: claude-code   ·   Attack paths: 1                                  │
│ Findings: 0C 3H 2M 0L                                                        │
│ Grade C (60/100)                                                             │
╰──────────────────────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────────────╮
│  HIGH   XR-AP-SKILL-EXFIL-001  Skill exfiltration path — skill reads secrets │
│ and emits network traffic                                                    │
│ ·  confidence MEDIUM  ·  runtime active-runtime                              │
│                                                                              │
│ Why this matters                                                             │
│ A skill capable of reading secrets and a skill capable of network egress     │
│ coexist in the active skill set. xrails treats this as a composite           │
│ exfiltration path.                                                           │
│                                                                              │
│ Fix                                                                          │
│ Remove sensitive-path references from skill bodies. Remove or constrain      │
│ network egress from skill bodies; route through approved tooling instead.    │
│ Review and tighten `allowed-tools` for every skill that does either. Add     │
│ deny rules for credential paths in project settings, and constrain           │
│ `WebFetch` to specific domains.                                              │
╰──────────────────────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────────────╮
│  HIGH   XR-SKILL-001  Skill declares broad allowed-tools (Bash, Read,        │
│ WebFetch wildcard)                                                           │
│ .claude/skills/deploy-helper/SKILL.md  ·  confidence HIGH  ·  runtime        │
│ active-runtime                                                               │
│                                                                              │
│ Why this matters                                                             │
│ Skill {{ skill.name }} declares allowed-tools that include a bare wildcard   │
│ capability. Skills should scope tools to the specific commands they need.    │
│                                                                              │
│ Fix                                                                          │
│ Replace `Bash` / `Bash(*)` with command-prefix scopes such as `Bash(npm run  │
│ *)` or `Bash(git status)`. Replace bare `Read` / `Read(*)` with path-scoped  │
│ reads. Replace `WebFetch` with `WebFetch(domain:...)` for each approved      │
│ endpoint. Consider whether the skill genuinely needs each declared tool.     │
╰──────────────────────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────────────╮
│  HIGH   XR-SKILL-002  Skill body contains shell exfiltration patterns        │
│ .claude/skills/deploy-helper/SKILL.md  ·  confidence MEDIUM  ·  runtime      │
│ active-runtime                                                               │
│                                                                              │
│ Why this matters                                                             │
│ Skill {{ skill.name }} body includes shell-exfil patterns:                   │
│ ['curl-uploads-file', 'base64-pipe-curl'].                                   │
│                                                                              │
│ Fix                                                                          │
│ Remove the data-exfil shell snippets from the skill body. If the skill needs │
│ to send data outward, route it through a controlled, allowlisted endpoint    │
│ and require approval. Add deny rules in the project settings for `Bash(curl  │
│ *)`, `Bash(wget *)`, `Bash(nc *)`.                                           │
╰──────────────────────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────────────╮
│  MEDIUM   XR-SKILL-003  Skill body instructs the agent to read sensitive     │
│ paths                                                                        │
│ .claude/skills/deploy-helper/SKILL.md  ·  confidence MEDIUM  ·  runtime      │
│ active-runtime                                                               │
│                                                                              │
│ Why this matters                                                             │
│ Skill {{ skill.name }} body references sensitive paths: ['env-file',         │
│ 'aws-creds'].                                                                │
│                                                                              │
│ Fix                                                                          │
│ Remove direct references to credential paths from the skill body. Add deny   │
│ rules for those paths in project settings: `Read(~/.aws/*)`,                 │
│ `Read(~/.ssh/*)`, `Read(./.env*)`. If the skill genuinely needs              │
│ configuration, accept it as a function argument or env var rather than       │
│ naming the file.                                                             │
╰──────────────────────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────────────╮
│  MEDIUM   XR-SKILL-004  Skill body tells the agent to skip approvals or run  │
│ dangerously                                                                  │
│ .claude/skills/deploy-helper/SKILL.md  ·  confidence MEDIUM  ·  runtime      │
│ active-runtime                                                               │
│                                                                              │
│ Why this matters                                                             │
│ Skill {{ skill.name }} body contains approval-bypass language. Skills should │
│ describe what to do, not how to subvert review gates.                        │
│                                                                              │
│ Fix                                                                          │
│ Remove "skip permissions", "don't ask", "auto-approve", and similar wording  │
│ from the skill body. Skills should state intent and constraints; permission  │
│ policy belongs in `.claude/settings.json`. For organizations, lock approval  │
│ policy via managed settings (`disableBypassPermissionsMode = "disable"`).    │
╰──────────────────────────────────────────────────────────────────────────────╯

5 findings (0 critical, 3 high, 2 medium, 0 low)   ·   active-runtime: 5
