Analyze SKILL.md frontmatter and content for security risk patterns.
npx skills add https://github.com/anysiteio/agent-skills --skill skill-audit-anysiteio
Please help me install this Agent Skill. Skill: skill-audit Source: https://github.com/anysiteio/agent-skills/tree/main/skills/skill-audit Command: npx skills add https://github.com/anysiteio/agent-skills --skill skill-audit-anysiteio
This Skill Audit helps security teams and developers ensure Claude Code skills, commands, and plugins are safe before deployment by performing read-only static analysis of SKILL.md frontmatter, body, and supporting files.
For local audits, run: /skill-audit skills/skill-audit For GitHub audits, run: /skill-audit https://github.com/owner/repo
High-intent search queries and answers about installing and using this skill.
Run a static security audit by passing the GitHub repository URL to the skill-audit command. It performs a read-only analysis of SKILL.md frontmatter, scripts, and hooks to surface risk patterns.
A static security audit reviews SKILL.md frontmatter, body content, scripts, and hooks to identify dangerous patterns and calculate risk scores. You need it before deploying new plugins to prevent unintended side effects.
Yes, you can audit locally installed skills by passing the local directory path to the skill-audit command. It performs a strict read-only analysis of the SKILL.md file and supporting components.
Read-only static analysis is limited to evaluating hardcoded patterns in frontmatter, scripts, and hooks. It cannot detect runtime vulnerabilities or dynamic execution issues, providing only risk scoring and hardening recommendations.
No, the security audit applies a strict read-only approach using tools like Read, Grep, and Glob to analyze files. It never executes or modifies the Claude Code skills being reviewed.
The 5-phase analysis enumerates frontmatter, body content, scripts, references, and hooks to surface risk patterns. It assigns a risk score and provides hardening recommendations to guide safe skill enablement.
shuymnClone public GitHub repositories and tree subdirectories into temporary local workspaces.
MohibShaikhAnalyze OpenClaw skills with a six-pass pipeline to identify threats and quality issues.
robertbr123Automate code review with security scans, quality checks, and automated fixes.
SPURSGOReviews C++ source code for security vulnerabilities, resource leaks, and coding standards.
