skill-security-analyzer

To audit a skill for security risks before installation, you can run a static analysis on the skill files and manifests to detect vulnerabilities like prompt injection and SSRF, producing a structured report with severity mappings and remediation guidance.

A static skill audit detects prompt injection, role hijacking, data exfiltration patterns, SSRF, dangerous filesystem access, obfuscation, and risky dependency configurations, mapping each finding to severity levels and OWASP categories.

Yes, you can inspect remote skill repositories for malicious code without executing scripts by performing a static analysis of files and manifests, preventing any skill scripts from running or fetching remote resources during the audit.

You check for unsafe filesystem access or obfuscation in a third-party skill by enumerating its files, scripts, and manifests to map the inspection surface, then applying static analysis to identify risky patterns and generate an actionable report.

Yes, a pre-install skill audit produces an actionable report template that includes an explicit install recommendation based on the structured findings, evidence, severity, and OWASP category mappings to help you decide whether to install, require fixes, or reject the skill.

The best way to analyze external agent skills for data exfiltration patterns is to perform a comprehensive static audit on the local skill folder or repository, avoiding execution and generating a clear verdict with remediation guidance before use.