skill-safety-scanner

Name: skill-safety-scanner
Availability: InStock
Author: SkillsCatalog

Scan Agent Skill directories for secrets and dangerous patterns across JavaScript, Python, and shell files.

1|1|Updated Jan 3, 2026

Search Tags:#security #permissions #safety #secrets #static-analysis #ci #scanner

Ready to run

npx skills add https://github.com/SkillsCatalog/registry --skill skill-safety-scanner

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-safety-scanner
Source: https://github.com/SkillsCatalog/registry/tree/main/skills/skill-safety-scanner
Command: npx skills add https://github.com/SkillsCatalog/registry --skill skill-safety-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Scans local Agent Skill directories to detect secrets, dangerous code patterns, and permission requirements before publishing.

Core Features & Use Cases

Detects hardcoded secrets and credentials in skill code and configuration.
Flags potentially dangerous code patterns (eval, shell commands, unsafe exec) across supported languages.
Reports required permissions (filesystem, network, subprocess) that a skill may request, aiding compliance and safety reviews.

Quick Start

Run the safety_scan.py script on your skill directory to generate a safety report.

Frequently Asked Questions about skill-safety-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan for hardcoded secrets before publishing code?▼

To scan for hardcoded secrets before publishing, run a safety scanner on your local skill directory to detect credentials and generate a safety report. The scanner analyzes JavaScript, Python, and shell files to identify embedded secrets and dangerous code patterns.

What's the best way to detect dangerous code patterns in shell scripts?▼

Detecting dangerous code patterns in shell scripts requires static analysis that flags unsafe eval and shell command executions. A dedicated safety scanner can parse these files locally and report potentially dangerous code patterns with graded risk scores.

How does static analysis identify required permissions for Agent Skills?▼

Static analysis identifies required permissions by scanning code for filesystem, network, and subprocess access patterns. It analyzes the skill directory contents to report the specific permissions a skill may request, aiding compliance and safety reviews before publishing.

Can I generate JSON safety reports for CI pipelines?▼

Yes, you can generate JSON safety reports suitable for CI pipelines. The safety scanner produces deterministic results with graded scores and per-dimension findings, offering both JSON and text output formats to integrate seamlessly into continuous integration workflows.

Does the safety scanner work with Python and JavaScript files?▼

Yes, the safety scanner works with Python and JavaScript files, alongside shell scripts. It analyzes code across these supported languages to detect secrets, dangerous patterns, and required permissions, producing a comprehensive safety report before publishing.

Why do I need to run a safety scan on local skill directories?▼

You need to run a safety scan on local skill directories to identify and report security risks before publishing. This process detects hardcoded secrets, flags dangerous code patterns, and verifies required permissions, ensuring compliance and preventing vulnerable code deployment.