skill-security-auditor

Scan AI agent skills for security vulnerabilities before installation.

2|Updated Mar 13, 2026

Search Tags:#security #vulnerability #audit #prompt injection #malware #code scanning

Ready to run

npx skills add https://github.com/zhangzhang-111-i/claude-skills111 --skill skill-security-auditor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skill-security-auditor
Source: https://github.com/zhangzhang-111-i/claude-skills111/tree/main/engineering/skill-security-auditor
Command: npx skills add https://github.com/zhangzhang-111-i/claude-skills111 --skill skill-security-auditor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill acts as a crucial security gate, scanning AI agent skills for potential vulnerabilities and malicious code before they are installed, protecting users from security threats.

Core Features & Use Cases

Code Scanning: Analyzes Python, Bash, and JavaScript scripts for dangerous patterns like command injection, code execution, and network exfiltration.
Prompt Injection Detection: Scans SKILL.md and reference files for attempts to override instructions, bypass safety filters, or exfiltrate data.
Dependency Analysis: Checks for typosquatting, unpinned versions, and runtime installation of packages.
Filesystem Auditing: Identifies suspicious file access, hidden files, and binary executables.
Use Case: Before installing a new skill from an unknown source, run this auditor to get a PASS/WARN/FAIL verdict, ensuring your AI environment remains secure.

Quick Start

Use the skill-security-auditor to audit the local skill directory located at '/path/to/skill-name/'.

Frequently Asked Questions about skill-security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What does prompt injection detection look for in SKILL.md and reference files?▼

Prompt injection detection involves scanning SKILL.md and reference files for attempts to override instructions, bypass safety filters, or exfiltrate data. This analysis identifies malicious patterns embedded in markdown files that could manipulate AI agent behavior.

How are dependency supply chain attacks identified during a skill audit?▼

Yes, you can audit Python and Bash scripts for command injection risks. Code scanning analyzes these scripts for dangerous patterns including command injection, code execution, and network exfiltration to ensure your AI environment remains secure before skill installation.

How are dependency supply chain attacks identified during a skill audit?▼

Yes, filesystem auditing identifies suspicious file access, hidden files, and binary executables. This process maps out potentially malicious filesystem abuse patterns within the skill directory to prevent unauthorized or dangerous file operations.

What is the best way to check for malicious code in an unknown AI skill?▼

The best way to check for malicious code in an unknown AI skill is to run a comprehensive security audit on the local skill directory. This evaluates code execution risks, prompt injection, dependency attacks, and filesystem abuse to yield a PASS, WARN, or FAIL verdict.