skills.rest
rovanni
rovanniCOMMUNITY
Explore all skills by this author →
GitHub

skill-auditor

Audit third-party skills by statically analyzing SKILL.md and related scripts.

1|Updated Mar 24, 2026
Search Tags:#security#skills#auditing#static-analysis#third-party#risk#quarantine
One-click install
npx skills add https://github.com/rovanni/IalClaw --skill skill-auditor-rovanni
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-auditor
Source: https://github.com/rovanni/IalClaw/tree/main/skills/internal/skill-auditor
Command: npx skills add https://github.com/rovanni/IalClaw --skill skill-auditor-rovanni

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Audita skills públicas ou de terceiros antes da ativação para garantir a segurança e a conformidade, realizando uma análise estática do conteúdo da skill sem executar código.

Core Features & Use Cases

  • Verifica a segurança estática do SKILL.md e de código associado para identificar padrões de risco.
  • Classifica riscos (segurança, privacidade, exfiltração, prompt injection) e gera um relatório estruturado.
  • Suporta decisões de ativação: aprovar, colocar em quarentena ou bloquear, com registro de auditoria.

Quick Start

Execute a auditoria estática sobre uma skill alvo usando o comando /skill-auditor <nome-da-skill>.

Frequently Asked Questions about skill-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit third-party skills for prompt injection before activation?▼

Static analysis of third-party skills detects prompt injection by inspecting SKILL.md content and associated scripts without executing code. It classifies risks like exfiltration and generates a structured safety report to approve, quarantine, or block activation.

What does static analysis of a SKILL.md file check for?▼

Static analysis of a SKILL.md file inspects prompts and associated scripts to identify security, privacy, exfiltration, and prompt injection risks. It consults risk references and emits a structured safety report to decide on approval, quarantine, or blocking.

Can I inspect quarantined skill repositories without executing code?▼

Yes, you can inspect quarantined skill repositories without executing code by applying static analysis. This verifies security by examining SKILL.md and related scripts for risk patterns, ensuring safe evaluation before approval or blocking decisions.

What is the best way to sanitize third-party skills for security compliance?▼

The best way to sanitize third-party skills for security compliance is through static analysis of SKILL.md and related scripts. This classifies risks, consults risk references, and produces a structured safety report with a decision to approve, quarantine, or block.

When should I block a third-party skill instead of quarantining it?▼

You should block a third-party skill instead of quarantining it when static analysis of its SKILL.md or scripts identifies severe security, exfiltration, or prompt injection risks. The structured safety report guides this decision by classifying the threat level.

Related Skills

Explore More Software Engineering Skills→
ratacatratacat
49

ebook-extractor

Convert EPUB, MOBI, PDF, AZW, and AZW3 ebooks to plain text.

Community
Intermediate
flowkraftflowkraft
75

Quality Assurance Skill

Validate email delivery, PDF attachments, and template rendering for report distribution.

Community
Advanced
jvalinskyjvalinsky

objc-concurrency-bug-audit

Audit Objective-C and Objective-C++ codebases for concurrency defects.

Community
Intermediate
managedcodemanagedcode
4

mcaf-dotnet-roslynator

Integrate Roslynator analyzers into .NET projects for C# static analysis and auto-fixing.

Official
Intermediate