Limitations. The main challenge here is how a malicious attack is blocked when wrapped in benign instructions

[solar-flare99]

Warden catches the script-kiddie version, example (literal os.system("curl ... | sh") in the skill's direct source). It does not catch the
sophisticated version where the payload is in a transitive dependency, obfuscated, or split across languages and indirection layers.

The real answer to why skill scanning is harder is exactly the gap we have: we'd need language-aware AST parsing, transitive dependency
resolution, and ideally runtime sandboxing to truly solve it. Regex over concatenated text is a useful first layer but not a complete solution

[Ar9av]

This is the hard part.

Most real attacks are not cartoonishly hostile. They arrive wrapped in a bugfix, a docs update, a setup step, or a test harness that sounds ordinary enough to slip past shallow rules. That means the system has to judge intent in context, not only pattern-match strings.

I'd keep the bar modest, though. You do not need perfect semantic understanding to raise the cost for attackers. You need enough friction at the risky edge that a benign-looking pivot into secrets, package installs, or policy rewrites stops feeling invisible.