skill-scanner

To scan Claude Code skills for prompt injection and security risks, audit the skill directory to analyze SKILL.md files, bundled scripts, and references for malicious patterns, generating a structured security assessment report.

Static analysis for agent skill security is the process of detecting unsafe code patterns, secret exposure, and risky permissions in skill definitions and scripts before installation, providing structured findings for security evaluation.

Yes, you can use this security scanner to validate third-party skill packages before installation by analyzing their skill definitions, bundled scripts, and supporting resources for malicious patterns and supply chain risks.

Yes, you need PyYAML installed to audit agent skill definitions, as the scanner requires this dependency to parse skill metadata and evaluate security findings.

A skill security audit can detect supply chain risks by checking for credential access, dangerous execution patterns, excessive tool permissions, and prompt injection attempts within the skill's scripts and definitions.

Static analysis for detecting malicious skill patterns is limited to identifying known suspicious signatures in skill definitions and scripts, meaning it provides structured findings for security evaluation but cannot execute code to uncover runtime vulnerabilities.