Skill
Skill Security Auditor
Scans a third-party agent skill for hostile code before it is installed.
Install
Ships scripts/plugin marketplace add alirezarezvani/claude-skills sonra /plugin install engineering-advanced-skills@claude-code-skills
Triggers on
Runs before installing any skill or plugin whose source is not trusted, as a gate rather than an afterthought.
Needs tools
BashRead
- Author
- Alireza Rezvani
- License
- MIT
Installing a skill from a stranger means running their scripts and reading their instructions, and neither is reviewed by default. The auditor walks the skill directory or a git URL and reports a PASS, WARN or FAIL: shell-out and eval patterns in the bundled scripts, calls that send data somewhere, file access that reaches outside the skill folder, risky dependencies, and prompt injection planted in the SKILL.md text itself. Output can be JSON, and strict mode promotes every warning to a failure so it can gate an automated install.
Comments(0)
Sign in to comment