Findings & checks · 1 flagged
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.md
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
editorconfig-enforcement
Claude Code plugin that enforces .editorconfig rules when writing or editing code.
What it does
- When a project has
.editorconfig, Claude Code strictly follows its settings - When a project has no
.editorconfig, it falls back to the bundled.editorconfig.example
Bundled defaults
| Scope | indent_style | indent_size |
|---|---|---|
[*] (global default) | tab | 4 |
*.go | tab | — |
Makefile / *.mk | tab | — |
*.py | space | 4 |
*.rs | space | 4 |
*.toml | space | 2 |
*.{yml,yaml} | space | 2 |
You can customize the fallback by editing skills/editorconfig-enforcement/.editorconfig.example.
Installation
/plugin install editorconfig-enforcement@shiyou0130011/Skill-of-editorconfigHow it works
The skill is set to disable-model-invocation: false, meaning Claude Code will automatically apply it whenever files are written or edited. No manual invocation needed.