skills/claudskills/malicious-skill

The changes below clear what held this to a D. Each is a concrete edit; re-run the litmus after to confirm the grade moves. See the full report for the matched evidence.

• S-04Dangerous bundled commands· high

  Dangerous command in a bundled file

  A bundled script runs a dangerous command — a piped remote installer, a destructive filesystem operation, or similar — that executes with the user’s privileges if the skill runs.

  Fix: Remove the command, or replace it with an explicit, reviewable step. Never pipe a remote script straight into a shell from a bundled file.

  at SKILL.md

  base64 -D | bash

npx -p @polygraphso/litmus polygraphso-litmus-skill <skill-dir>