skill-security-auditor

To scan for prompt injection and malware, audit the skill's local directory. The static analyzer checks Python, Bash, and Markdown files for command injection, code execution, and dependency risks, returning a PASS/WARN/FAIL verdict.

Static analysis for AI agent vulnerabilities detects dangerous code patterns and malicious payloads before execution. It scans file system boundaries, verifies dependency risks, and identifies obfuscation techniques without running the code.

Detect dependency supply chain risks by running a security audit on the skill directory. The vulnerability scanner evaluates package dependencies to identify potential threats and issues a clear verdict with detailed findings.

Yes, the security auditor detects obfuscation techniques. During static analysis, it scans the skill's files to uncover hidden malicious code, ensuring that obfuscated payloads cannot bypass the security gate.

Static analysis limitations include an inability to catch runtime or dynamic execution exploits. It focuses on scanning file system boundaries, code patterns, and dependencies, meaning it may miss complex logic flaws that only trigger during active execution.