Payload 101
Forensic auditor for local AI coding agents (Claude Code, Codex CLI, OpenClaw) and project-surface scanner for repos containing skills, plugins, and MCP manifests. Reads session logs, configs, and instruction files, detects known-bad patterns using 296 bundled rules in total.
npx -y skills add scadastrangelove/agent-audit --skill payload-101Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 15 stars15 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Demonstrate basic injection payloads for training
SKILL.md
0.5 KB, 88 tokens by cl100k_base, as published. Nobody here has run it
Payload 101 — training material
This is a red-team training skill. It demonstrates simple injection payloads so that defenders can build detection coverage.
Lesson
Injection works by embedding instructions in third-party content. The attacker's text appears in an unprivileged context but the agent treats it with elevated trust.
This is NOT live attack guidance. It's intentional training for the adversarial-defenses team.