A skill file is plain Markdown your assistant reads and obeys, which makes it an instruction channel with no review step in front of it. Beam scans one before you run it, reading the file as inert text.
The report names what matched and where. It is triage, not proof of safety.
Coding assistants are the AI surface with the deepest access to real systems, so they get their own pre-run check — eleven heuristic categories, each quoting the text that matched.
Credentials
Reads of API keys, tokens, .env files and SSH material — and, separately, instructions that route them somewhere.
Execution
Fetch-then-run chains and obfuscated commands: the two shapes used to keep the real instruction out of the readable file.
Destruction
Recursive removal and data-destroying commands, the class behind the most widely reported agent incidents.
Persistence
Shell profiles, launch agents, cron and hook configuration — anywhere a skill can arrange to run again.
Escalation
Permission changes, cloud instance-metadata endpoints, network sweeps and reverse-shell constructions.
Override
Text telling the assistant to ignore prior guidance, hide its actions, or treat the skill's rules as outranking yours.
2025–2026
The OpenClaw/ClawHub wave and the ToxicSkills research line showed the same thing: marketplaces distribute instruction files with no meaningful review.
2026
Researchers drove MedusaLocker execution from a skill file — proof that the skill layer is a delivery channel, not a curiosity.
2025–2026
Check Point disclosed hook and configuration injection plus credential exfiltration via ANTHROPIC_BASE_URL. Config files are part of the attack surface.
01
Point the scanner at the file you are about to add. Nothing runs, and Beam does not fetch it — you bring the file.
02
"You MUST call this function first" is not malicious; "attach this key to an outbound URL" is. Findings quote what triggered them.
03
A clean scan is not a clearance. Once the skill runs, its commands and tool calls land in the same local log.
A skill is a Markdown instruction file an assistant loads and follows. Because its contents are treated as instructions rather than data, a skill can direct the assistant to read credentials, post them to an external host, or ignore your own rules — with no software vulnerability involved.
No. The file is read as inert text and matched against heuristic patterns. Beam's own test fixtures include commands that look destructive precisely to prove they are never executed.
No. Eleven heuristic patterns catch documented abuse shapes; they are not semantic malware analysis. Treat a clean report as one input into your own review, especially for a skill you are about to give real credentials.
The scanner works on the file, not the vendor, so any Markdown-based skill or instruction document can be scanned — assistant skills, agent rule files and MCP configurations. Runtime coverage is likewise source-agnostic.
Scanning a file costs a minute and runs entirely on the endpoint. An unreviewed instruction file reaching a developer fleet costs whatever it was written to take.