Qsearch— agent skill

Qsearch — independently scanned and version-tracked by SaferSkills.

by theYahia·Agent Skill·github.com/theYahia/qsearch

Is Qsearch safe to install?

SaferSkills independently audited Qsearch (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 266 high-severity and 5 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

Score
45/100
●●●●●○○○○○
Re-scan~30s
Latest scan
ScannedJun 25, 2026 · 132d ago
Scans run0 over 90 days
Detectors55 checks · 5 categories
Findings5 warnings · 266 high
EngineSaferSkills 2b638c6
View methodology →
SaferSkills installs
This week0
This month0
All time0
CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
0
0.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
100
20.0 pts
Maintenancestaleness, pinning, CI
15%
100
15.0 pts
TransparencySKILL.md, perms, README
15%
100
15.0 pts
Communityinstalls, verify, response
15%
100
15.0 pts

Findings & checks · 271 flagged

Securityscore 0 · 271 findings
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_biznes.json×33
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_biznes.json· json
29"netloc": "appointer.ua",
30"hostname": "appointer.ua",
31"favicon": "https://imgs.search.brave.com/5VCAGp7v5myA1w8oLRgPDvUuiQFZP1CaYCjejinVRHw/rs:fit
… (98 chars elided on L31)
32"path": "› ru › programma-dlya-sto"
33}
Occurrences
33 occurrences · first at L31, also L44, L57 +30 more
Show all 33 locations
Line
File
L31
_tmp_forumdisc/brave/disc_biznes.json
L44
_tmp_forumdisc/brave/disc_biznes.json
L57
_tmp_forumdisc/brave/disc_biznes.json
L70
_tmp_forumdisc/brave/disc_biznes.json
L83
_tmp_forumdisc/brave/disc_biznes.json
L96
_tmp_forumdisc/brave/disc_biznes.json
L237
_tmp_forumdisc/brave/disc_biznes.json
L262
_tmp_forumdisc/brave/disc_biznes.json
L287
_tmp_forumdisc/brave/disc_biznes.json
L291
_tmp_forumdisc/brave/disc_biznes.json
L312
_tmp_forumdisc/brave/disc_biznes.json
L337
_tmp_forumdisc/brave/disc_biznes.json
L422
_tmp_forumdisc/brave/disc_biznes.json
L433
_tmp_forumdisc/brave/disc_biznes.json
L513
_tmp_forumdisc/brave/disc_biznes.json
L524
_tmp_forumdisc/brave/disc_biznes.json
L640
_tmp_forumdisc/brave/disc_biznes.json
L651
_tmp_forumdisc/brave/disc_biznes.json
L743
_tmp_forumdisc/brave/disc_biznes.json
L754
_tmp_forumdisc/brave/disc_biznes.json
L773
_tmp_forumdisc/brave/disc_biznes.json
L786
_tmp_forumdisc/brave/disc_biznes.json
L799
_tmp_forumdisc/brave/disc_biznes.json
L812
_tmp_forumdisc/brave/disc_biznes.json
L825
_tmp_forumdisc/brave/disc_biznes.json
L838
_tmp_forumdisc/brave/disc_biznes.json
L919
_tmp_forumdisc/brave/disc_biznes.json
L930
_tmp_forumdisc/brave/disc_biznes.json
L950
_tmp_forumdisc/brave/disc_biznes.json
L963
_tmp_forumdisc/brave/disc_biznes.json
L976
_tmp_forumdisc/brave/disc_biznes.json
L1181
_tmp_forumdisc/brave/disc_biznes.json
L1192
_tmp_forumdisc/brave/disc_biznes.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256c10885f42693754f…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_chiptuner.json×19
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_chiptuner.json· json
35"netloc": "chiptuner.ru",
36"hostname": "chiptuner.ru",
37"favicon": "https://imgs.search.brave.com/hqEYW-EnDJafbYgoWDznWHojtgkjyscvHGC4S4ZoQj4/rs:fit
… (98 chars elided on L37)
38"path": "› forum › forumdisplay.php"
39},
Occurrences
19 occurrences · first at L37, also L60, L106 +16 more
Show all 19 locations
Line
File
L37
_tmp_forumdisc/brave/disc_chiptuner.json
L60
_tmp_forumdisc/brave/disc_chiptuner.json
L106
_tmp_forumdisc/brave/disc_chiptuner.json
L152
_tmp_forumdisc/brave/disc_chiptuner.json
L175
_tmp_forumdisc/brave/disc_chiptuner.json
L198
_tmp_forumdisc/brave/disc_chiptuner.json
L221
_tmp_forumdisc/brave/disc_chiptuner.json
L315
_tmp_forumdisc/brave/disc_chiptuner.json
L326
_tmp_forumdisc/brave/disc_chiptuner.json
L377
_tmp_forumdisc/brave/disc_chiptuner.json
L388
_tmp_forumdisc/brave/disc_chiptuner.json
L406
_tmp_forumdisc/brave/disc_chiptuner.json
L417
_tmp_forumdisc/brave/disc_chiptuner.json
L470
_tmp_forumdisc/brave/disc_chiptuner.json
L481
_tmp_forumdisc/brave/disc_chiptuner.json
L555
_tmp_forumdisc/brave/disc_chiptuner.json
L566
_tmp_forumdisc/brave/disc_chiptuner.json
L610
_tmp_forumdisc/brave/disc_chiptuner.json
L621
_tmp_forumdisc/brave/disc_chiptuner.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256349e42c04dd70998…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_complaint_soft.json×11
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_complaint_soft.json· json
148"netloc": "youtube.com",
149"hostname": "www.youtube.com",
150"favicon": "https://imgs.search.brave.com/Wg4wjE5SHAargkzePU3eSLmWgVz84BEZk1SjSglJK_U/rs:fit
… (98 chars elided on L150)
151"path": "› watch"
152},
Occurrences
11 occurrences · first at L150, also L175, L201 +8 more
Show all 11 locations
Line
File
L150
_tmp_forumdisc/brave/disc_complaint_soft.json
L175
_tmp_forumdisc/brave/disc_complaint_soft.json
L201
_tmp_forumdisc/brave/disc_complaint_soft.json
L227
_tmp_forumdisc/brave/disc_complaint_soft.json
L252
_tmp_forumdisc/brave/disc_complaint_soft.json
L466
_tmp_forumdisc/brave/disc_complaint_soft.json
L477
_tmp_forumdisc/brave/disc_complaint_soft.json
L534
_tmp_forumdisc/brave/disc_complaint_soft.json
L545
_tmp_forumdisc/brave/disc_complaint_soft.json
L939
_tmp_forumdisc/brave/disc_complaint_soft.json
L950
_tmp_forumdisc/brave/disc_complaint_soft.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256ce5575f84f51ec60…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_diag.json×24
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_diag.json· json
35"netloc": "chiptuner.ru",
36"hostname": "chiptuner.ru",
37"favicon": "https://imgs.search.brave.com/hqEYW-EnDJafbYgoWDznWHojtgkjyscvHGC4S4ZoQj4/rs:fit
… (98 chars elided on L37)
38"path": "› forum › forumdisplay.php"
39},
Occurrences
24 occurrences · first at L37, also L83, L240 +21 more
Show all 24 locations
Line
File
L37
_tmp_forumdisc/brave/disc_diag.json
L83
_tmp_forumdisc/brave/disc_diag.json
L240
_tmp_forumdisc/brave/disc_diag.json
L251
_tmp_forumdisc/brave/disc_diag.json
L269
_tmp_forumdisc/brave/disc_diag.json
L280
_tmp_forumdisc/brave/disc_diag.json
L297
_tmp_forumdisc/brave/disc_diag.json
L308
_tmp_forumdisc/brave/disc_diag.json
L328
_tmp_forumdisc/brave/disc_diag.json
L339
_tmp_forumdisc/brave/disc_diag.json
L356
_tmp_forumdisc/brave/disc_diag.json
L367
_tmp_forumdisc/brave/disc_diag.json
L455
_tmp_forumdisc/brave/disc_diag.json
L466
_tmp_forumdisc/brave/disc_diag.json
L515
_tmp_forumdisc/brave/disc_diag.json
L526
_tmp_forumdisc/brave/disc_diag.json
L546
_tmp_forumdisc/brave/disc_diag.json
L557
_tmp_forumdisc/brave/disc_diag.json
L574
_tmp_forumdisc/brave/disc_diag.json
L585
_tmp_forumdisc/brave/disc_diag.json
L724
_tmp_forumdisc/brave/disc_diag.json
L735
_tmp_forumdisc/brave/disc_diag.json
L811
_tmp_forumdisc/brave/disc_diag.json
L822
_tmp_forumdisc/brave/disc_diag.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256349e42c04dd70998…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_legion.json×13
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_legion.json· json
136"url": "https://forum.autodata.ru/",
137"long_name": "forum.autodata.ru",
138"img": "https://imgs.search.brave.com/FRBCwdC8q0UgEevg8efeg29UhlYugl7BBF0KnFHI4qU/rs:fit:32:
… (98 chars elided on L138)
139},
140"language": "ru",
Occurrences
13 occurrences · first at L138, also L149, L472 +10 more
Show all 13 locations
Line
File
L138
_tmp_forumdisc/brave/disc_legion.json
L149
_tmp_forumdisc/brave/disc_legion.json
L472
_tmp_forumdisc/brave/disc_legion.json
L483
_tmp_forumdisc/brave/disc_legion.json
L613
_tmp_forumdisc/brave/disc_legion.json
L624
_tmp_forumdisc/brave/disc_legion.json
L628
_tmp_forumdisc/brave/disc_legion.json
L641
_tmp_forumdisc/brave/disc_legion.json
L883
_tmp_forumdisc/brave/disc_legion.json
L958
_tmp_forumdisc/brave/disc_legion.json
L969
_tmp_forumdisc/brave/disc_legion.json
L1067
_tmp_forumdisc/brave/disc_legion.json
L1078
_tmp_forumdisc/brave/disc_legion.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256a82144c56b5534d4…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_parts_cat.json×19
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_parts_cat.json· json
161"url": "https://avtostandart.by/partscat/",
162"long_name": "avtostandart.by",
163"img": "https://imgs.search.brave.com/KNok017n1ChVDyKGGQo1TjfEu_dbJlQQpkkyYphvM9o/rs:fit:32:
… (98 chars elided on L163)
164},
165"language": "ru",
Occurrences
19 occurrences · first at L163, also L174, L198 +16 more
Show all 19 locations
Line
File
L163
_tmp_forumdisc/brave/disc_parts_cat.json
L174
_tmp_forumdisc/brave/disc_parts_cat.json
L198
_tmp_forumdisc/brave/disc_parts_cat.json
L209
_tmp_forumdisc/brave/disc_parts_cat.json
L236
_tmp_forumdisc/brave/disc_parts_cat.json
L247
_tmp_forumdisc/brave/disc_parts_cat.json
L372
_tmp_forumdisc/brave/disc_parts_cat.json
L383
_tmp_forumdisc/brave/disc_parts_cat.json
L409
_tmp_forumdisc/brave/disc_parts_cat.json
L420
_tmp_forumdisc/brave/disc_parts_cat.json
L442
_tmp_forumdisc/brave/disc_parts_cat.json
L453
_tmp_forumdisc/brave/disc_parts_cat.json
L457
_tmp_forumdisc/brave/disc_parts_cat.json
L586
_tmp_forumdisc/brave/disc_parts_cat.json
L597
_tmp_forumdisc/brave/disc_parts_cat.json
L724
_tmp_forumdisc/brave/disc_parts_cat.json
L735
_tmp_forumdisc/brave/disc_parts_cat.json
L761
_tmp_forumdisc/brave/disc_parts_cat.json
L772
_tmp_forumdisc/brave/disc_parts_cat.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256f9f23a214e97a09f…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_zakaznaryad.json×19
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_zakaznaryad.json· json
148"netloc": "youtube.com",
149"hostname": "www.youtube.com",
150"favicon": "https://imgs.search.brave.com/Wg4wjE5SHAargkzePU3eSLmWgVz84BEZk1SjSglJK_U/rs:fit
… (98 chars elided on L150)
151"path": "› watch"
152},
Occurrences
19 occurrences · first at L150, also L154, L175 +16 more
Show all 19 locations
Line
File
L150
_tmp_forumdisc/brave/disc_zakaznaryad.json
L154
_tmp_forumdisc/brave/disc_zakaznaryad.json
L175
_tmp_forumdisc/brave/disc_zakaznaryad.json
L200
_tmp_forumdisc/brave/disc_zakaznaryad.json
L225
_tmp_forumdisc/brave/disc_zakaznaryad.json
L280
_tmp_forumdisc/brave/disc_zakaznaryad.json
L291
_tmp_forumdisc/brave/disc_zakaznaryad.json
L305
_tmp_forumdisc/brave/disc_zakaznaryad.json
L316
_tmp_forumdisc/brave/disc_zakaznaryad.json
L404
_tmp_forumdisc/brave/disc_zakaznaryad.json
L415
_tmp_forumdisc/brave/disc_zakaznaryad.json
L542
_tmp_forumdisc/brave/disc_zakaznaryad.json
L553
_tmp_forumdisc/brave/disc_zakaznaryad.json
L686
_tmp_forumdisc/brave/disc_zakaznaryad.json
L703
_tmp_forumdisc/brave/disc_zakaznaryad.json
L730
_tmp_forumdisc/brave/disc_zakaznaryad.json
L741
_tmp_forumdisc/brave/disc_zakaznaryad.json
L786
_tmp_forumdisc/brave/disc_zakaznaryad.json
L797
_tmp_forumdisc/brave/disc_zakaznaryad.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256ce5575f84f51ec60…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_forumdisc/brave/disc_zapchasti.json×9
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_forumdisc/brave/disc_zapchasti.json· json
35"netloc": "service-core.com.ua",
36"hostname": "www.service-core.com.ua",
37"favicon": "https://imgs.search.brave.com/MG9HuRFNndHaO5veUNbSvWJxCmNUDgQzGV8zmC5Msno/rs:fit
… (98 chars elided on L37)
38"path": "› forum › topic2935-gde-seichas-luchshe-zakazyvat-avtozapchasti.html"
39},
Occurrences
9 occurrences · first at L37, also L359, L370 +6 more
Show all 9 locations
Line
File
L37
_tmp_forumdisc/brave/disc_zapchasti.json
L359
_tmp_forumdisc/brave/disc_zapchasti.json
L370
_tmp_forumdisc/brave/disc_zapchasti.json
L494
_tmp_forumdisc/brave/disc_zapchasti.json
L505
_tmp_forumdisc/brave/disc_zapchasti.json
L525
_tmp_forumdisc/brave/disc_zapchasti.json
L536
_tmp_forumdisc/brave/disc_zapchasti.json
L709
_tmp_forumdisc/brave/disc_zapchasti.json
L720
_tmp_forumdisc/brave/disc_zapchasti.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256e86c2ed5551bf9db…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_clinic_admin.json×14
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_clinic_admin.json· json
138"url": "https://flowframe.ru/blog/kak-snizit-no-show-v-klinike-s-24-do-7-protsentov/",
139"long_name": "flowframe.ru",
140"img": "https://imgs.search.brave.com/qQhmad9EcYWh_ReMcQ57BVB2_jUCiygLYTgHJHy_CHU/rs:fit:32:
… (98 chars elided on L140)
141},
142"language": "ru",
Occurrences
14 occurrences · first at L140, also L151, L182 +11 more
Show all 14 locations
Line
File
L140
_tmp_med2/brave/med_clinic_admin.json
L151
_tmp_med2/brave/med_clinic_admin.json
L182
_tmp_med2/brave/med_clinic_admin.json
L193
_tmp_med2/brave/med_clinic_admin.json
L601
_tmp_med2/brave/med_clinic_admin.json
L612
_tmp_med2/brave/med_clinic_admin.json
L659
_tmp_med2/brave/med_clinic_admin.json
L670
_tmp_med2/brave/med_clinic_admin.json
L855
_tmp_med2/brave/med_clinic_admin.json
L866
_tmp_med2/brave/med_clinic_admin.json
L923
_tmp_med2/brave/med_clinic_admin.json
L934
_tmp_med2/brave/med_clinic_admin.json
L1003
_tmp_med2/brave/med_clinic_admin.json
L1014
_tmp_med2/brave/med_clinic_admin.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha2562f8ea905436159b8…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_egisz.json×13
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_egisz.json· json
147"netloc": "youtube.com",
148"hostname": "www.youtube.com",
149"favicon": "https://imgs.search.brave.com/Wg4wjE5SHAargkzePU3eSLmWgVz84BEZk1SjSglJK_U/rs:fit
… (98 chars elided on L149)
150"path": "› watch"
151},
Occurrences
13 occurrences · first at L149, also L174, L199 +10 more
Show all 13 locations
Line
File
L149
_tmp_med2/brave/med_egisz.json
L174
_tmp_med2/brave/med_egisz.json
L199
_tmp_med2/brave/med_egisz.json
L225
_tmp_med2/brave/med_egisz.json
L251
_tmp_med2/brave/med_egisz.json
L275
_tmp_med2/brave/med_egisz.json
L286
_tmp_med2/brave/med_egisz.json
L348
_tmp_med2/brave/med_egisz.json
L359
_tmp_med2/brave/med_egisz.json
L747
_tmp_med2/brave/med_egisz.json
L758
_tmp_med2/brave/med_egisz.json
L893
_tmp_med2/brave/med_egisz.json
L904
_tmp_med2/brave/med_egisz.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256ce5575f84f51ec60…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_habr.json×12
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_habr.json· json
329"url": "https://kontur.ru/lp/segmentplus/blog/80491-egisz_v_medicine",
330"long_name": "kontur.ru",
331"img": "https://imgs.search.brave.com/xqZ5_2QGMDs1MFiMHRD4CwuvFsKF999CFl2SoEev0N4/rs:fit:32:
… (98 chars elided on L331)
332},
333"language": "ru",
Occurrences
12 occurrences · first at L331, also L342, L481 +9 more
Show all 12 locations
Line
File
L331
_tmp_med2/brave/med_habr.json
L342
_tmp_med2/brave/med_habr.json
L481
_tmp_med2/brave/med_habr.json
L492
_tmp_med2/brave/med_habr.json
L543
_tmp_med2/brave/med_habr.json
L554
_tmp_med2/brave/med_habr.json
L691
_tmp_med2/brave/med_habr.json
L702
_tmp_med2/brave/med_habr.json
L787
_tmp_med2/brave/med_habr.json
L798
_tmp_med2/brave/med_habr.json
L869
_tmp_med2/brave/med_habr.json
L880
_tmp_med2/brave/med_habr.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256b26183b45708fbd8…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_infostart_med.json×31
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_infostart_med.json· json
147"netloc": "youtube.com",
148"hostname": "www.youtube.com",
149"favicon": "https://imgs.search.brave.com/Wg4wjE5SHAargkzePU3eSLmWgVz84BEZk1SjSglJK_U/rs:fit
… (98 chars elided on L149)
150"path": "› watch"
151},
Occurrences
31 occurrences · first at L149, also L175, L201 +28 more
Show all 31 locations
Line
File
L149
_tmp_med2/brave/med_infostart_med.json
L175
_tmp_med2/brave/med_infostart_med.json
L201
_tmp_med2/brave/med_infostart_med.json
L262
_tmp_med2/brave/med_infostart_med.json
L273
_tmp_med2/brave/med_infostart_med.json
L334
_tmp_med2/brave/med_infostart_med.json
L345
_tmp_med2/brave/med_infostart_med.json
L373
_tmp_med2/brave/med_infostart_med.json
L384
_tmp_med2/brave/med_infostart_med.json
L485
_tmp_med2/brave/med_infostart_med.json
L496
_tmp_med2/brave/med_infostart_med.json
L516
_tmp_med2/brave/med_infostart_med.json
L527
_tmp_med2/brave/med_infostart_med.json
L547
_tmp_med2/brave/med_infostart_med.json
L558
_tmp_med2/brave/med_infostart_med.json
L693
_tmp_med2/brave/med_infostart_med.json
L704
_tmp_med2/brave/med_infostart_med.json
L750
_tmp_med2/brave/med_infostart_med.json
L761
_tmp_med2/brave/med_infostart_med.json
L794
_tmp_med2/brave/med_infostart_med.json
L805
_tmp_med2/brave/med_infostart_med.json
L858
_tmp_med2/brave/med_infostart_med.json
L869
_tmp_med2/brave/med_infostart_med.json
L889
_tmp_med2/brave/med_infostart_med.json
L900
_tmp_med2/brave/med_infostart_med.json
L920
_tmp_med2/brave/med_infostart_med.json
L931
_tmp_med2/brave/med_infostart_med.json
L1013
_tmp_med2/brave/med_infostart_med.json
L1024
_tmp_med2/brave/med_infostart_med.json
L1125
_tmp_med2/brave/med_infostart_med.json
L1136
_tmp_med2/brave/med_infostart_med.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256ce5575f84f51ec60…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_mis_complaint.json×11
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_mis_complaint.json· json
147"netloc": "youtube.com",
148"hostname": "www.youtube.com",
149"favicon": "https://imgs.search.brave.com/Wg4wjE5SHAargkzePU3eSLmWgVz84BEZk1SjSglJK_U/rs:fit
… (98 chars elided on L149)
150"path": "› watch"
151},
Occurrences
11 occurrences · first at L149, also L174, L199 +8 more
Show all 11 locations
Line
File
L149
_tmp_med2/brave/med_mis_complaint.json
L174
_tmp_med2/brave/med_mis_complaint.json
L199
_tmp_med2/brave/med_mis_complaint.json
L291
_tmp_med2/brave/med_mis_complaint.json
L302
_tmp_med2/brave/med_mis_complaint.json
L508
_tmp_med2/brave/med_mis_complaint.json
L519
_tmp_med2/brave/med_mis_complaint.json
L825
_tmp_med2/brave/med_mis_complaint.json
L836
_tmp_med2/brave/med_mis_complaint.json
L917
_tmp_med2/brave/med_mis_complaint.json
L928
_tmp_med2/brave/med_mis_complaint.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256ce5575f84f51ec60…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_rms.json×2
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_rms.json· json
568"url": "https://education.almazovcentre.ru/en/2026/03/23/vserossijskij-nauchno-obrazovatelny
… (98 chars elided on L568)
569"long_name": "education.almazovcentre.ru",
570"img": "https://imgs.search.brave.com/z5g-iW6RjAvZgPy51oIeXrmCJml_FwAUIhczKm5MjI0/rs:fit:32:
… (98 chars elided on L570)
571},
572"language": "en",
Occurrences
2 occurrences · first at L570, also L581
Show all 2 locations
Line
File
L570
_tmp_med2/brave/med_rms.json
L581
_tmp_med2/brave/med_rms.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256c6f2eca5a2302781…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_stom_soft.json×27
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_stom_soft.json· json
58"netloc": "woman.ru",
59"hostname": "www.woman.ru",
60"favicon": "https://imgs.search.brave.com/WAcG462Bbtvrnu55Yh2782c3xyh8WxtLuQGp4lN40Mo/rs:fit
… (98 chars elided on L60)
61"path": "› health › dentistry › forum"
62},
Occurrences
27 occurrences · first at L60, also L106, L241 +24 more
Show all 27 locations
Line
File
L60
_tmp_med2/brave/med_stom_soft.json
L106
_tmp_med2/brave/med_stom_soft.json
L241
_tmp_med2/brave/med_stom_soft.json
L252
_tmp_med2/brave/med_stom_soft.json
L313
_tmp_med2/brave/med_stom_soft.json
L324
_tmp_med2/brave/med_stom_soft.json
L349
_tmp_med2/brave/med_stom_soft.json
L360
_tmp_med2/brave/med_stom_soft.json
L404
_tmp_med2/brave/med_stom_soft.json
L415
_tmp_med2/brave/med_stom_soft.json
L441
_tmp_med2/brave/med_stom_soft.json
L452
_tmp_med2/brave/med_stom_soft.json
L466
_tmp_med2/brave/med_stom_soft.json
L477
_tmp_med2/brave/med_stom_soft.json
L516
_tmp_med2/brave/med_stom_soft.json
L527
_tmp_med2/brave/med_stom_soft.json
L553
_tmp_med2/brave/med_stom_soft.json
L564
_tmp_med2/brave/med_stom_soft.json
L630
_tmp_med2/brave/med_stom_soft.json
L641
_tmp_med2/brave/med_stom_soft.json
L764
_tmp_med2/brave/med_stom_soft.json
L775
_tmp_med2/brave/med_stom_soft.json
L854
_tmp_med2/brave/med_stom_soft.json
L865
_tmp_med2/brave/med_stom_soft.json
L885
_tmp_med2/brave/med_stom_soft.json
L914
_tmp_med2/brave/med_stom_soft.json
L925
_tmp_med2/brave/med_stom_soft.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha2568a8a30e1cd330682…rubric 365aacaView on GitHub
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · _tmp_med2/brave/med_telemed.json×9
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters

A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.

The exact value spotted
excerpt_tmp_med2/brave/med_telemed.json· json
137"url": "https://zdrav.expert/index.php/%D0%A1%D1%82%D0%B0%D1%82%D1%8C%D1%8F:%D0%A2%D0%B5%D0%
… (98 chars elided on L137)
138"long_name": "zdrav.expert",
139"img": "https://imgs.search.brave.com/w-YuWh1YO0v09eOPPskFkDBtOB8gYSe59szkiMPirVk/rs:fit:32:
… (98 chars elided on L139)
140},
141"language": "ru",
Occurrences
9 occurrences · first at L139, also L150, L448 +6 more
Show all 9 locations
Line
File
L139
_tmp_med2/brave/med_telemed.json
L150
_tmp_med2/brave/med_telemed.json
L448
_tmp_med2/brave/med_telemed.json
L459
_tmp_med2/brave/med_telemed.json
L804
_tmp_med2/brave/med_telemed.json
L815
_tmp_med2/brave/med_telemed.json
L883
_tmp_med2/brave/med_telemed.json
L894
_tmp_med2/brave/med_telemed.json
L923
_tmp_med2/brave/med_telemed.json
How to fix
Remove the encoded blob, or decode it and review what it actually contains.
  1. Decode the base64 string and confirm it is not an instruction directed at the agent.
  2. Move any legitimate binary or signature data into a dedicated file (*.sig, SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-B64-PAYLOAD-01sha256a15407fd9f018452…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/hn-first-comment.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/hn-first-comment.md· markdown
502. **Reply to every comment within 10 minutes** for first 30 minutes.
513. **DO NOT delete and re-post** the HN submission if it underperforms.
524. **DO NOT ask for upvotes** anywhere (Twitter, Reddit, Slack, Discord, friends DMs).
535. **If shadow-flagged:** email `[email protected]` ONE polite line per launch-calendar lin
… (7 chars elided on L53)
54 
Occurrences
1 occurrence · at L52
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha2563507b488e8245eb0…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/launch-calendar.md×2
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/launch-calendar.md· markdown
96### 13:30 UTC (06:30 PT) — Pre-flight (30 min before)
97- [ ] Hydrate. Phone DND on except @ replies.
98- [ ] Open tabs: HN submit / your post URL placeholder / Twitter draft / 3 close friends Sla
… (69 chars elided on L98)
99 
100### **14:00 UTC (07:00 PT) — Show HN submission** ⭐ LOAD-BEARING
Occurrences
2 occurrences · first at L98, also L130
Show all 2 locations
Line
File
L98
docs/launch-calendar.md
L130
docs/launch-calendar.md
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha2563507b488e8245eb0…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/launch/POSTING_PLAN.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/launch/POSTING_PLAN.md· markdown
51 
52**X / Mastodon**
53- Teaser can pre-seed the network. Never link the HN item before it's landed (and never ask
… (30 chars elided on L53)
54 
55## Sequence (day-of-week + audience-hour)
Occurrences
1 occurrence · at L53
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/launch/POST_HN.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/launch/POST_HN.md· markdown
109- [ ] Paste the first comment immediately after submitting — don't wait.
110- [ ] Reply to every comment within ~10 min for the first 2 hours. Technical, no marketing.
111- [ ] Best window: a US-morning weekday slot (see POSTING_PLAN.md). Never ask for upvotes an
… (7 chars elided on L111)
112 
113---
Occurrences
1 occurrence · at L111
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub
Supply chainscore 100 · 0 findings
✓—All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenancescore 100 · 0 findings
✓—All maintenance checks passedNo findings in this category for the latest scan.pass
Transparencyscore 100 · 0 findings
✓—All transparency checks passedNo findings in this category for the latest scan.pass
Communityscore 100 · 0 findings
✓—All community checks passedNo findings in this category for the latest scan.pass
Vendor response · right of reply
Are you the maintainer? Submit a response →

Audit the pieces. Scan the whole. Decide.

~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.