secure-skill

What problem does it solve?

Prevents unsafe or malicious agent skills from entering the skill library or agent context by scanning SKILL.md files, repository contents, and bundled artifacts for prompt injection, data exfiltration, credential theft, supply-chain risks, obfuscation, and instruction-hierarchy violations.

Core Features & Use Cases

• Multi-check security audit: Runs six targeted checks (prompt injection, data exfiltration, credential access, privilege escalation, supply-chain, obfuscation) across all files in scope.
• Orchestration and enforcement: Dispatches sibling secure-* validators, enforces an instruction hierarchy that prevents lower-trust content from overriding security policy, and produces aSAFE/BLOCKED/REQUIRES REVIEW verdict.
• Use Cases: Gate external SKILL.md ingestion, audit third-party skill installs, perform full library security sweeps, and vet community skills prior to improvement or publication.

Quick Start

Scan the repository's SKILL.md and related files for prompt injection, credential leaks, supply-chain risks, and obfuscation and return a clear SAFE, BLOCKED, or REQUIRES REVIEW verdict.