Findings & checks · 6 flagged
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · docs/pages/pmd/devdocs/github_actions_workflows.md×6
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
Show all 6 locations
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
PMD - source code analyzer
PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex, but supports 16 other languages. It comes with 400+ built-in rules. It can be extended with custom rules. It uses JavaCC and Antlr to parse source files into abstract syntax trees (AST) and runs rules against them to find violations. Rules can be written in Java or using a XPath query.
Currently, PMD supports Java, JavaScript, Salesforce.com Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML and XSL. Scala is supported, but there are currently no Scala rules available.
Additionally, it includes CPD, the copy-paste-detector. CPD finds duplicated code in Coco, C/C++, C#, CSS, Dart, Fortran, Gherkin, Go, Groovy, HTML, Java, JavaScript, JSP, Julia, Kotlin, Lua, Matlab, Modelica, Objective-C, Perl, PHP, PL/SQL, Python, Ruby, Salesforce.com Apex and Visualforce, Scala, Swift, T-SQL, Typescript, Apache Velocity, WSDL, XML and XSL.
🚀️ Installation and Usage
Download the latest binary zip from the releases and extract it somewhere.
Execute bin/pmd check or bin\pmd.bat check.
See also Getting Started
Demo:
This shows how PMD analyses openjdk:
Demo
There are plugins for Maven and Gradle as well as for various IDEs. See Tools / Integrations
ℹ️ How to get support?
- How do I? -- Ask a question on StackOverflow
or on discussions.
- I got this error, why? -- Ask a question on StackOverflow
or on discussions.
- I got this error and I'm sure it's a bug -- file an issue.
- I have an idea/request/question -- create a new discussion.
- I have a quick question -- ask in our Gitter room
or our PMD Guru at Gurubase.
- Where's your documentation? -- <https://docs.pmd-code.org/latest/>
🤝️ Contributing
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
Our latest source of PMD can be found on GitHub. Fork us!
For details, see How to contribute to PMD.
The rule designer is developed over at pmd/pmd-designer. Please see its README for developer documentation.
💵️ Financial Contributors
Become a financial contributor and help us sustain our community. Contribute
✨️ Contributors
This project follows the all-contributors specification. Contributions of any kind welcome!
See credits for the complete list.