Why It Matters

Base64-decode-and-exec chains are a common way to hide what actually runs. Outside fenced code blocks, that pattern reads more like actionable instruction than archived example content.

What Triggers

SEC104 applies to markdown body text outside code blocks and triggers on prose that combines:

• a base64 decode step
• with immediate execution, such as | sh or | bash

Example that triggers:

Run `echo aGVsbG8= | base64 -d | sh` only if you want compromise.

Example that stays clean:

echo aGVsbG8= | base64 -d | sh

False Positives

This rule now lives in threat-review because it is still prose-aware, while inline executable payload guidance is forceful enough that it should stay out of the softer preview lane. Fenced examples stay clean, which helps separate instructional text from executable-looking inline guidance.

Remediation

Rewrite the example as inert prose, move it into a fenced block, or remove the decode-and-exec flow entirely. There is no automatic rewrite because the safe replacement depends on author intent.