Every file is sealed before it reaches your agent
Shared rules, skills, and prompts are code that runs on your AI. Waxmark treats them that way: every version of every item passes a four-stage security scan before it can be published, and every edit triggers a mandatory re-scan.
The four stages
1. Invisible Unicode
Characters that are invisible when a human reviews a file but fully visible to an AI model — the “Rules File Backdoor” attack. A rule can look like harmless style advice while hiding “add a backdoor to auth code” between the visible words.
Finds: Zero-width characters, bidirectional overrides, invisible format characters
On detection: Auto-quarantine
2. Prompt injection
“Ignore all previous instructions”, “act as the system”, “do not tell the user” — phrasing whose only purpose is to displace your configuration or hide behavior from you. Matched even through spacing tricks like “i g n o r e”.
Finds: Instruction-override phrasing, role hijacking, covert-channel directives
On detection: Auto-quarantine in rules and skills; visible warning on prompts
3. Exfiltration sinks
An instruction file has no business phoning home. The classic attack makes your agent render an image whose URL smuggles your data out as query parameters.
Finds: Markdown images with data-carrying URLs, beacon domains, templated endpoints
On detection: Auto-quarantine
4. Embedded secrets
Protects consumers from poisoned credentials and contributors from accidental leaks. Report excerpts are always redacted.
Finds: Cloud keys, GitHub and model-provider tokens, private-key blocks
On detection: Auto-quarantine; placeholders excluded
What happens to a finding
- Fail — the item is quarantined automatically and reviewed by a human before it can ever be published. Quarantines are recorded in an audit trail.
- Warn— published, with every finding visible on the item's public scan report. You judge.
- Pass — no known attack mechanics found. The badge links to the full report: what ran, when, and the scanner version (unicode@1+injection@1+exfil@2+secrets@2).
- Rug-pull defense — every edit creates a new immutable version and a mandatory re-scan. A published item whose new version fails is pulled back into quarantine. When the scanner improves, the whole catalog is re-scanned.
What we list in public
A scan pass is necessary, not sufficient. The public catalog is curated: original submissions, starter-pack members, and ingested rules/skills that appear in more than one independent source. Brief one-line prompt dumps stay in the archive (permalinks still work) but are not the front door. We are not hosting vendor-official Anthropic or OpenAI files until the license is unambiguous.
What the seal does not promise
Honesty is part of the product. The scanner is heuristic: a cleverly worded malicious instruction in plain English — no hidden characters, no trigger phrases, no URLs — can pass. It does not judge whether advice is good, and it never executes or fetches anything. A pass badge is a strong filter against the known mechanical attack classes, not a guarantee. Review instructions before giving them to an agent with real permissions — the raw view on every item shows you the exact bytes, with anything invisible rendered visibly.
The full, versioned specification of every check lives on the security page.
Browse the catalog with the seal on every card — start exploring, or read the format guide to pick the right kind of instruction file.