skill-auditor

To vet agent skills before installation, apply a structured 6-step protocol that audits metadata, permissions, dependencies, and prompts to prevent prompt injection and enforce a safety quality gate.

A skill auditing protocol checks for typosquatting and permission abuse by validating metadata and analyzing permissions during skill installation, ensuring only safe, compliant skills are adopted from sources like GitHub.

You audit agent skills for network exfiltration and unsafe dependencies by running a pre-install gatekeeper protocol that scans dependencies and network safeguards to mitigate data leak risks.

You should run a security audit on an existing SKILL.md file during continuous audits when permissions change, or when evaluating skill updates, to identify and mitigate newly introduced risks.

Yes, you can use skill auditing to check content safety and metadata validation by applying standardized criteria for pass/fail across a 6-step protocol covering typosquat checks and prompt-injection scans.

The limitations of automated skill auditing involve enforcing a standardized pass/fail quality gate, which requires a structured 6-step protocol and clear criteria to accurately identify risk without false negatives.