Skill Security Auditor
Scans a third-party agent skill for hostile code before it is installed.
Install
Ships scripts/plugin marketplace add alirezarezvani/claude-skills sonra /plugin install engineering-advanced-skills@claude-code-skills
Runs before installing any skill or plugin whose source is not trusted, as a gate rather than an afterthought.
- Author
- Alireza Rezvani
- License
- MIT
Installing a skill from a stranger means running their scripts and reading their instructions, and neither is reviewed by default. The auditor walks the skill directory or a git URL and reports a PASS, WARN or FAIL: shell-out and eval patterns in the bundled scripts, calls that send data somewhere, file access that reaches outside the skill folder, risky dependencies, and prompt injection planted in the SKILL.md text itself. Output can be JSON, and strict mode promotes every warning to a failure so it can gate an automated install.
Similar skills
Using Superpowers
SkillThe entry point that forces a skill lookup before the agent says or does anything.
Signed Audit Trails
SkillA single cookbook skill that explains signed tool-call receipts before you commit to running them.
Skill Creator
SkillWalks an agent through writing, testing and tightening a new skill
Comments(0)
Sign in to comment