nerlo-skill-scanner — install-doc
Nerlo-originalNerlo-original install-instruction analysis — the FakeGit README shape.
What it scans
READMEs, SKILL, and INSTALL documentation across every acquired surface. The malice this detector looks for lives in the documentation that directs the user to execute something — not necessarily in the code.
What it catches
- curl-pipe-bash — instructions that pipe a fetched script straight into a shell.
- Decode-then-run — instructions to decode a bundled blob and execute the result.
- “Run resource.txt” — instructions to execute a bundled or release-archive artifact.
- “Double-click setup.exe” — instructions to run a bundled executable.
The FakeGit story
In the FakeGit/SmartLoader campaign, roughly 800 fake MCP-server repositories cloned a legitimate Oura Ring MCP server. The tracked git source was clean. The payload — an obfuscated LuaJIT dropper that staged into SmartLoader and then StealC — shipped as a GitHub release asset, and the README quietly told the user to run it.
That is the exact shape this detector is built for: the exploit is the documentation. “Download and run this file” is the attack, and a scanner that only reads source code never sees it.
Live detection demo
We publish a benign public canary — a defanged FakeGit-shaped repository carrying no working payload — so anyone can watch Nerlo flag it Unsafe for the right reasons. The canary lives at github.com/nerlo-ai/nerlo-canary-fakegit. These are the validated findings from that scan:
- curl-pipe-to-shell (ERROR) — install-instruction-exec class.
- “Run resource.txt” (WARNING).
- “Double-click setup.exe” (WARNING).
- No findings — the tracked source is clean by design.
Why this matters
Three findings on the README alone are enough to drive the artifact to Unsafe: the weaponization is in the instructions, exactly as in FakeGit.
A git-source-only scan reads clean code and calls the artifact Verified. Reading the README as part of the artifact is what catches the directed execution.
See the same lesson generalized across every distribution surface in the scoring methodology.
Source and provenance
Nerlo pins and publishes each scanner's provenance so you can verify it yourself. Every scan surfaces the source, version, and install command in its report.
- Kind
- Nerlo-original
- Source channel
- Nerlo-original (built in-house)
- Pinned version
- shipped in the deployed scanner image
- License
- Nerlo
- Source URL
- https://github.com/nerlo-ai/nerlo-canary-fakegit