Claude
Skill
neutralize-sd11
SD-11 scanner-mediated injection — neutralize untrusted skill bytes before any model; additive-only scoring. Use when touching L2, MCP, prompts, envelopes, or scoring merge.
Virus-scanned
Reviewed automatically before listing.
Download
kalarislabs-skill-doctor-skills_neutralize-sd11-72aa35f.zip · 0 KB
Install
skills CLI
npx skills add https://github.com/KalarisLabs/Skill-Doctor/tree/main/skills/neutralize-sd11
Claude Code
claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install kalarislabs-skill-doctor@llmmart
Git
git clone https://github.com/KalarisLabs/Skill-Doctor.git
The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole kalarislabs/skill-doctor collection as a plugin from our marketplace. Git is the plain clone.
Skill manifest
SD-11
If the scanner forwards skill text to a model, the scanner is the injection surface.
- Strip bidi / zero-width / tag chars; record removals as findings.
- NFKC + UTS #39 skeleton; homoglyphs are findings, not silent folds.
- Remaining text goes in a fenced untrusted envelope. No raw skill in the model prompt.
- Host returns schema-constrained JSON only.
- Merge: L2 may add or raise. L2 may not delete or downgrade L1.
- If neutralize fails: do not call the model; reduce L2 coverage.
No vendor LLM SDK on the default CLI path. Product L2 is MCP mode=host.
Files (skill-doctor)
-
SKILL.md 798 B
--- name: neutralize-sd11 description: SD-11 scanner-mediated injection — neutralize untrusted skill bytes before any model; additive-only scoring. Use when touching L2, MCP, prompts, envelopes, or scoring merge. --- # SD-11 If the scanner forwards skill text to a model, the scanner is the injection surface. 1. Strip bidi / zero-width / tag chars; record removals as findings. 2. NFKC + UTS #39 skeleton; homoglyphs are findings, not silent folds. 3. Remaining text goes in a fenced untrusted envelope. No raw skill in the model prompt. 4. Host returns schema-constrained JSON only. 5. Merge: L2 may add or raise. L2 may not delete or downgrade L1. 6. If neutralize fails: do not call the model; reduce L2 coverage. No vendor LLM SDK on the default CLI path. Product L2 is MCP `mode=host`.
Comments (0)
Sign in to join the conversation.
Reviews (0)
No reviews yet.
No comments yet.