skill-scanner

To scan a skill for security vulnerabilities, you target the skill's directory path to initiate static analysis, which inspects code files for malicious code, credential exfiltration, prompt injection, and suspicious network calls.

A skill code audit detects security risks including credential exfiltration, prompt injection, obfuscated code, and suspicious network calls by performing static analysis against defined threat detection rules.

You should run a malware scan on downloaded skills before installing them from any untrusted source to verify safety, ensure integrity, and confirm the files do not attempt to steal API keys or inject malicious prompts.

Yes, you can use static analysis to detect prompt injection in skill scripts by analyzing the code files against defined security rules to identify suspicious patterns and potential malicious activities.

No, the skill security scanner requires no external dependencies to function, relying entirely on its internal scripts and references to perform static code analysis and threat detection.