CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

0.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 295 flagged

Securityscore 0 · 295 findings

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · packages/core/src/__tests__/fixtures/cgr_attestation_v1_jcs.golden.json

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted

excerptpackages/core/src/__tests__/fixtures/cgr_attestation_v1_jcs.golden.json· json

24"issuer": "gns-foundation",

25"issuer_key_id": "d04ab232742bb4ab3a1368bd4615e4e6d0224ab71a016baf8520a332c9778737",

26"signature": "6b6271fe501f7b43f70781996aacb22ec50484420adde52c4f58c0224faa202188f20e340345e3

… (52 chars elided on L26)

27"evidence_ref": null

28}

Occurrences

1 occurrence · at L26

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256f0bcd2e8baf303ba…rubric 365aacaView on GitHub

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · packages/core/src/__tests__/fixtures/cgr_attestation_v2_jcs.golden.json

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

The exact value spotted

excerptpackages/core/src/__tests__/fixtures/cgr_attestation_v2_jcs.golden.json· json

29"issuer": "gns-foundation",

30"issuer_key_id": "d04ab232742bb4ab3a1368bd4615e4e6d0224ab71a016baf8520a332c9778737",

31"signature": "6d5327981a79e7a40c10b9ddd8c67df33f3f9e3456b832bda9334b6b0fcac83aaec9725aa425fb

… (52 chars elided on L31)

32"evidence_ref": null

33}

Occurrences

1 occurrence · at L31

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha25675bcffc946fdf2e9…rubric 365aacaView on GitHub

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · packages/core/src/__tests__/fixtures/cgr_attestation_v3_jcs.golden.json

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

The exact value spotted

excerptpackages/core/src/__tests__/fixtures/cgr_attestation_v3_jcs.golden.json· json

30"issuer": "gns-foundation",

31"issuer_key_id": "d04ab232742bb4ab3a1368bd4615e4e6d0224ab71a016baf8520a332c9778737",

32"signature": "b5e936fd3b514d2f6a9abbefa45efc90846c43d180d5fbf7fea01f08fdbb785cbcaab83c12b145

… (52 chars elided on L32)

33"evidence_ref": null

34}

Occurrences

1 occurrence · at L32

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha2567698ad53f737d538…rubric 365aacaView on GitHub

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · packages/core/src/__tests__/fixtures/cgr_attestation_v3_read_jcs.golden.json

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

The exact value spotted

excerptpackages/core/src/__tests__/fixtures/cgr_attestation_v3_read_jcs.golden.json· json

30"issuer": "gns-foundation",

31"issuer_key_id": "d04ab232742bb4ab3a1368bd4615e4e6d0224ab71a016baf8520a332c9778737",

32"signature": "cade627f695124eb18ccbda2ac521cf0e18817e85b36b8b52aa0bdf1de3f99679716c1f4686453

… (52 chars elided on L32)

33"evidence_ref": null

34}

Occurrences

1 occurrence · at L32

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256257c20071082a247…rubric 365aacaView on GitHub

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · packages/core/src/__tests__/fixtures/cgr_rotation_chain_jcs.golden.json

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

The exact value spotted

excerptpackages/core/src/__tests__/fixtures/cgr_rotation_chain_jcs.golden.json· json

16"seq": 1,

17"not_before": "2026-01-01T00:00:00Z",

18"sig": "c24760f4c56ab0fca157698feaceb292ae7274cf4bd6d4d29c9a1ac196be9c2190e55de8d444a4b52c0d

… (45 chars elided on L18)

19}

20],

Occurrences

1 occurrence · at L18

How to fix

Remove the encoded blob, or decode it and review what it actually contains.

Decode the base64 string and confirm it is not an instruction directed at the agent.
Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256c8c579e7a4cd060c…rubric 365aacaView on GitHub

HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · packages/core/src/__tests__/fixtures/conformance/cgr-attestation-v4/vectors.json×287

HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.

Why it matters

The exact value spotted

excerptpackages/core/src/__tests__/fixtures/conformance/cgr-attestation-v4/vectors.json· json

63}

64],

65"signature": "858a3a3cf194bab3cac2956b7b32d0ebbee6dca40c7c62620ccae0699d42af7fd7dfcfcf0fb19c

… (52 chars elided on L65)

66"evidence_ref": null

67},

Occurrences

287 occurrences · first at L65, also L91, L149 +284 more

Show all 287 locations

Line

File

L65