skill-audit

To audit AI agent skills for security vulnerabilities and prompt injection, you analyze the skill directory including SKILL.md, references, scripts, and evals.json to identify supply chain risks and structural quality issues, producing structured findings and a final verdict.

You can scan a registry of AI agent skills for supply chain risks by running batch audits across the entire skill registry, enforcing frontmatter metadata validation and evals presence, to generate structured findings and machine-readable reports for governance.

An AI agent skill structural quality audit checks frontmatter metadata validation, presence of evals, and analyzes SKILL.md, references, scripts, and evals.json to identify quality gaps and output actionable findings with severity and category.

The security audit enforces the presence of evals as part of its structural quality check. It analyzes the skill directory including evals.json to identify vulnerabilities, improper prompts, and structural quality gaps before producing a deployment verdict.

Yes, the security audit generates both human-readable and machine-readable reports. It produces actionable findings with severity, category, and remediation guidance for single-skill audits and batch registry scans.

Yes, pyyaml is a required dependency to run the security audit. It processes the skill directory components including SKILL.md and frontmatter metadata to validate structure and identify prompt injection risks.