Audit Claude skill packages for security risks and vulnerabilities before deployment.
npx skills add https://github.com/nejcm/agents --skill audit-skills-nejcm
Please help me install this Agent Skill. Skill: audit-skills Source: https://github.com/nejcm/agents/tree/main/skills/audit-skills Command: npx skills add https://github.com/nejcm/agents --skill audit-skills-nejcm
High-intent search queries and answers about installing and using this skill.
Provide the skill directory or .skill file and request a security analysis. The audit reviews SKILL.md instructions, scripts, references, and assets against known security patterns, then returns severity-rated findings and a checklist.
Common risks include data exfiltration to undisclosed endpoints, prompt injection, hardcoded credentials, obfuscated code using base64 or eval, dangerous subprocess calls, and instruction-override attempts that hijack agent behavior.
Yes. A .skill file is a zip archive that gets extracted first, then its SKILL.md, scripts, references, and assets are analyzed individually. Third-party skills from unknown sources receive heightened scrutiny during the review.
The report contains an executive summary, a findings list rated CRITICAL through LOW with evidence, positive security observations, and a 10-category checklist covering network access, PII handling, supply chain risks, and credential exposure.
The audit is evidence-based on visible code and instructions, so heavily obfuscated payloads or runtime-only behaviors may evade detection. Skills from unknown provenance should still receive manual code review before deployment.
Kilo-OrgClone GitHub skill directories and update SKILL.md metadata for marketplace integration.
ncsound919Evaluate AI agent skills for security risks before installation.
getsentryScan agent skills for security vulnerabilities using static analysis and pattern matching.
alexgreenshRetrieves the most relevant prior-session checkpoint as fenced, scrubbed recovery context.
