AG-SKILL-CHAIN: Undeclared High-Risk Capability Chain

What this rule means

A skill composes multiple high-risk primitives (e.g. remote fetch + exec) across prose and scripts, and fails to declare at least one in its manifest.

Why it matters

The Tencent Zhuque ClawHavoc backdoor (2026) disguised a remote-code-execution chain as a 'state recovery' tool. The whole point of the disguise is that the manifest does not admit to the chain.

How to fix it

Explicitly declare all capabilities in the SKILL.md frontmatter using `allowed-tools` or `compatibility`.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-SKILL-CHAIN          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules