feat: detect pkexec in SKILL-SH-003 privilege wrappers

CHANGELOG.md

@@ -24,6 +24,8 @@ All notable changes to this project are documented here, following
 ### Fixed
 
 - Apply prompt-injection (`prose`) rules to `.txt` and `.yaml`/`.yml` files, not only markdown.
+- Detect `pkexec` privilege escalation alongside `sudo`, `doas`, and `run0` in SKILL-SH-003,
+  preserving its medium severity and code-only scope.
 
 ## [0.1.6] - 2026-09-11
 

README.md

@@ -60,7 +60,7 @@ It reads `SKILL.md` **prose** for instruction-injection and reads **scripts and
 
 Directory scans include `.bat`, `.cmd`, `.fish`, and `.psm1` scripts alongside the other supported script and text formats. Extensions are matched case-insensitively, including in nested directories.
 
-Privilege escalation rule `SKILL-SH-003` flags `sudo`, `doas`, and `run0` in
+Privilege escalation rule `SKILL-SH-003` flags `sudo`, `doas`, `run0`, and `pkexec` in
 scripts and fenced code, with medium severity.
 
 See every rule: `npx @royalpinto007/skill-audit --rules`.

src/rules.js

@@ -65,9 +65,9 @@ export const RULES = [
     pattern: /(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(sh|bash|zsh|python[0-9.]*|node)\b/gi },
 
   { id: "SKILL-SH-003", severity: "medium", category: "dangerous-shell", appliesTo: "code",
-    title: "Privilege escalation via sudo, doas, or run0",
-    remediation: "A skill running sudo, doas, or run0 can change the whole system. Confirm it is truly required.",
-    pattern: /(^|[\s;&|(])(?:sudo|doas|run0)\s+/gm },
+    title: "Privilege escalation via sudo, doas, run0, or pkexec",
+    remediation: "A skill running sudo, doas, run0, or pkexec can change the whole system. Confirm it is truly required.",
+    pattern: /(^|[\s;&|(])(?:sudo|doas|run0|pkexec)\s+/gm },
 
   { id: "SKILL-SH-004", severity: "critical", category: "dangerous-shell", appliesTo: "code",
     title: "Fork bomb",

test/privilege-wrappers.test.js

@@ -4,7 +4,7 @@ import { scanText } from "../src/scan.js";
 
 test("privilege escalation rule detects sudo, doas and run0 in scripts and fences", () => {
   // Scanner input only: no commands are executed.
-  for (const command of ["sudo", "doas", "run0"]) {
+  for (const command of ["sudo", "doas", "run0", "pkexec"]) {
     for (const prefix of ["", "echo ok; ", "true && ", "(", "echo ok\n"]) {
       const source = `${prefix}${command} reboot\n`;
       for (const [text, file] of [[source, "setup.sh"], [`\`\`\`sh\n${source}\`\`\`\n`, "SKILL.md"]]) {
@@ -17,9 +17,9 @@ test("privilege escalation rule detects sudo, doas and run0 in scripts and fence
 });
 
 test("privilege escalation rule keeps command boundaries and prose exclusion", () => {
-  for (const text of ["mydoas reboot", "run01 reboot", "sudoers file", "doas-helper reboot"]) {
+  for (const text of ["mydoas reboot", "run01 reboot", "pkexec1 reboot", "sudoers file", "doas-helper reboot"]) {
     assert.equal(scanText(text, "setup.sh", null).filter((f) => f.rule === "SKILL-SH-003").length, 0);
   }
-  assert.equal(scanText("Discuss sudo, doas and run0 carefully.\n", "SKILL.md", null)
+  assert.equal(scanText("Discuss sudo, doas, run0 and pkexec carefully.\n", "SKILL.md", null)
     .filter((f) => f.rule === "SKILL-SH-003").length, 0);
 });