skill-audit

To scan scripts and agent definitions for hard-coded secrets and dangerous patterns, run an audit tool that analyzes frontmatter permissions, detects high-risk Python and Bash code, and identifies exposed keys or tokens to prevent unsafe deployments.

Yes, you can automatically fix missing allowed-tools and replace unsafe eval calls by running the security audit with the auto-fix flag enabled, which safely remediates detected permission issues and dangerous code patterns.

Yes, security auditing for agent skills supports CI pipeline integration by returning appropriate exit codes, automatically failing the pipeline when high-severity vulnerabilities such as excessive tool permissions or exposed secrets are detected.

Common security vulnerabilities found in skill and agent definitions include overly permissive tool access, missing frontmatter fields, exposed hard-coded secrets like API keys, and high-risk Python or Bash code patterns.

The best way to audit all skills for missing frontmatter and permission issues is to execute a comprehensive scan that analyzes frontmatter fields and detects excessive tool permissions across all agent and skill definitions.

Automated fixing of security risks in Python and Bash scripts is limited to safe issues only, such as adding missing allowed-tools and replacing unsafe eval calls, ensuring that complex or high-severity vulnerabilities require manual review.