audit-third-party-software

Audit third-party software for security and privacy risks before installation.

Updated Feb 19, 2026

Search Tags:#static analysis #security audit #supply chain #third-party risk #telemetry detection #binary inspection #safe install

Ready to run

npx skills add https://github.com/kzarzycki/agent-skills --skill audit-third-party-software

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-third-party-software
Source: https://github.com/kzarzycki/agent-skills/tree/main/engineering/skills/audit-third-party-software
Command: npx skills add https://github.com/kzarzycki/agent-skills --skill audit-third-party-software

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and scripts (resource) components.

What problem does it solve?

This Skill prevents unsafe installs by auditing third-party software before you clone, install, or run it.

Core Features & Use Cases

Static safety audit of repos, tarballs, binaries, packages, and Claude Code plugins before execution.
Verdict with evidence that classifies risk as SAFE, CAUTION, or UNSAFE with file-level, line-level citations and concrete observations.
Threat-focused checks for telemetry/data exfiltration, prompt injection risks, supply-chain attacks, closed-source phone-home behavior, secrets/credential handling, and unsafe local services.
Binary deep inspection guidance for extracting URLs/domains from a strings dump and triaging them into benign vs unknown vs cloud-SDK.

Quick Start

Ask the AI to audit the third-party software you plan to install from a provided GitHub URL and produce a SAFE/CAUTION/UNSAFE verdict with file:line citations and an install recommendation.

Frequently Asked Questions about audit-third-party-software

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit third-party software for security risks before installing it?▼

To audit third-party software for security risks, perform isolated static analysis on repos, tarballs, binaries, or plugins to detect telemetry, prompt injection, and credential leakage, producing a SAFE, CAUTION, or UNSAFE verdict with file-level citations.

What is static analysis for supply chain safety in unfamiliar GitHub repositories?▼

Static analysis for supply chain safety involves reviewing unfamiliar GitHub repositories before execution to identify telemetry, data exfiltration, and unsafe local services, yielding an evidence-backed triage with domain classification and a structured safety report.

How do I check a binary for telemetry and phone-home behavior?▼

To check a binary for telemetry and phone-home behavior, extract URLs and domains from a strings dump, then triage them into benign, unknown, or cloud-SDK categories to identify potential closed-source data exfiltration risks.

Can I use this to audit Claude Code plugins for prompt injection risks?▼

Yes, you can audit Claude Code plugins for prompt injection risks by applying threat-focused static checks to the plugin code, generating a structured safety verdict with actionable install recommendations and line-level citations.

What's the best way to triage third-party risk for a safe install?▼

The best way to triage third-party risk for a safe install is to execute isolated static analysis focusing on supply-chain behavior, secrets handling, and unsafe local services, resulting in an evidence-backed SAFE, CAUTION, or UNSAFE report.

When should I not rely solely on static analysis for software safety?▼

Static analysis may be insufficient when binaries contain obfuscated telemetry or dynamic payload fetching that masks phone-home behavior, requiring additional runtime monitoring to fully validate safe installation criteria.