SW-SKL-036: Frontmatter pre-approves an unscoped shell or interpreter

What it detects

The rule reads the leading frontmatter of SKILL.md, and of each Markdown file inside a folder named commands or agents, and looks only at its allowed-tools key, which may be a comma or space separated string, a flow list or a block list. An entry is reported when it is a shell tool (Bash, Shell or PowerShell, in any case) with no scope, with a wildcard scope such as Bash(*) or Bash(:*), or with a scope that is a general interpreter or launcher alone.

General interpreters include python, node, deno, bun, ruby, perl, sh, bash, zsh, pwsh, npx, uvx and pip, with or without a version number, and launchers such as env, xargs, sudo and nohup count when they stand alone or are followed by one. A scope that gives an interpreter inline code, or -m with no module, is general too. A shell scoped to one task, such as a gh pr view command, is quiet. The body of the file, a subagent's tools list and nested keys are not read. Each entry is a finding at its own line, with at most five per file, and the severity is always medium.

Why it matters

The allowed tools line lets a skill run those tools without the usual prompt. A shell with no limit, or limited to an interpreter, can run any command at all, so the grant works as a way around approvals even when nothing else in the skill looks wrong. The scanner maps this rule to OWASP ASI02, Tool Misuse and Exploitation, and ASI03, Identity and Privilege Abuse, and to NIST SP 800-53 controls AC-6, Least Privilege, and CM-7, Least Functionality.

Example

This skill lists a plain Bash entry in its allowed tools, which names the shell with no scope:

.claude/skills/shell-helper/SKILL.md

---
name: shell-helper
description: Runs small shell tasks for the user.
license: MIT
version: 1.0.0
allowed-tools: Read, Bash
---

# Shell helper

Run the task the user names.

The finding is on the allowed-tools line, with the entry as evidence.

How to fix

Scope each shell entry to the commands the skill actually runs, for example one named program and its arguments, and drop the entry if the skill needs no shell. Keep the list short enough for a reviewer to read in one look.

If it is a false positive

A skill whose whole job is to run user-chosen commands, such as a terminal helper, may need the broad grant. Accept the finding with a note that says so, and keep the expiry short so the grant is looked at again.

If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.

Related rules

• SW-SKL-003: Instructions to skip approvals or disable hooks
• SW-SKL-005: Writes to agent configuration