skill-injection-auditor

Audit user-defined skills for prompt injection and data exfiltration vulnerabilities.

Updated May 11, 2026

Search Tags:#security analysis #prompt injection #skill audit #data exfiltration #malicious code detection

Ready to run

npx skills add https://github.com/Marcu-Loreto/Skill_v1 --skill skill-injection-auditor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-injection-auditor
Source: https://github.com/Marcu-Loreto/Skill_v1/tree/main/.agents/skills/skill-injection-auditor
Command: npx skills add https://github.com/Marcu-Loreto/Skill_v1 --skill skill-injection-auditor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Claude API, python, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive audit of user-defined skills to detect potential security risks like prompt injection, malicious instructions, and data exfiltration.

Core Features & Use Cases

Skill Audit: Automatically scan and analyze the SKILL.md file and its related scripts, references, and assets for security vulnerabilities.
Heuristic Analysis: Detects patterns indicative of malicious intent or risky behavior.
Semantic Analysis: Uses Claude API to analyze the skill's content for hidden or malicious intent.
Use Case: When you want to ensure the safety of a skill before using it, you can activate this skill to perform an audit.

Quick Start

Run the skill-injection-auditor on a skill by executing the following command: python /path/to/skill-injection-auditor/scripts/audit_skill.py --path /path/to/skill

Frequently Asked Questions about skill-injection-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit custom skills for prompt injection and data exfiltration vulnerabilities?▼

To audit custom skills for prompt injection and data exfiltration, you can automate the analysis of SKILL.md files and related scripts. This process scans for malicious instructions and risky patterns using both heuristic pattern matching and semantic evaluation.

What is heuristic and semantic analysis for malicious code detection in skills?▼

Heuristic and semantic analysis detects malicious code by scanning for indicative behavioral patterns and evaluating hidden intent. Heuristic analysis flags risky syntax, while semantic analysis uses the Claude API to understand contextual security vulnerabilities.

Do I need a Python environment and Claude API access to run a skill security audit?▼

Yes, you need a Python environment and Claude API access to execute the skill security audit. The semantic analysis component specifically relies on the Claude API to evaluate the skill's content for hidden malicious instructions and data exfiltration attempts.

Can I scan skill assets and references automatically for security risks before deployment?▼

Yes, you can automatically scan skill assets and references for security risks before deployment. The audit process evaluates the entire skill directory, including related scripts and reference files, to ensure safety prior to activation.

What's the best way to detect hidden malicious instructions in user-defined skills?▼

The best way to detect hidden malicious instructions in user-defined skills is combining heuristic pattern detection with semantic analysis. This dual approach catches both explicit malicious code and subtle prompt injection vectors embedded in natural language.