R020 · script-security
Skill text and scripts free of dangerous patterns
- Code: R020
- Slug:
script-security - Tier: heuristic
- Default severity: warning
- Packages: minimal, recommended, strict
- Locked: Yes (safety: cannot be disabled or demoted)
- Doc: https://doraval.dev/reference/rules/R020
| What | Scans Skill description, body, and bundled scripts/ for injection phrases, disable-safety orders, and secret + outbound patterns. Heuristic, not a sandbox. Locked (safety). |
| Why | Untrusted Skill text is a supply-chain surface. Locked so a package cannot suppress security warnings. A public curl with no secrets is not a hit. |
How to fix
Remove the dangerous operation when possible. If you must keep it, narrow scope, validate input, and make the risk explicit in the skill body.