skills.rest
lagarcess
lagarcessCOMMUNITY
Explore all skills by this author →
GitHub

skill-security-auditor

Scan AI agent skill directories for security vulnerabilities and malicious patterns.

1|Updated Apr 4, 2026
Search Tags:#security#audit#static-analysis#supply-chain#prompt-injection#vulnerability-scan#ai-skills
One-click install
npx skills add https://github.com/lagarcess/argus --skill skill-security-auditor-lagarcess
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-security-auditor
Source: https://github.com/lagarcess/argus/tree/main/.agent/skills/skill-security-auditor
Command: npx skills add https://github.com/lagarcess/argus --skill skill-security-auditor-lagarcess

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The skill-security-auditor eliminates the risk of installing malicious or unsafe AI agent skills by statically scanning skill packages and repositories for code execution risks, prompt injection, supply-chain issues, and filesystem boundary violations before installation.

Core Features & Use Cases

  • Static code scanning for Python, shell, and JavaScript files to detect eval/exec, shell injection, raw sockets, and obfuscation patterns.
  • Prompt injection detection in SKILL.md and markdown references to find override directives, hidden characters, and exfiltration instructions.
  • Dependency and supply-chain checks for requirements, pyproject.toml, and package.json including typosquatting and unpinned versions.
  • CI/Pre-install gating: integrate into CI pipelines to block risky skills and produce structured PASS/WARN/FAIL reports with remediation guidance.
  • Use Case: A platform operator audits third-party skills submitted to a marketplace and automatically rejects those with critical findings.

Quick Start

Run the skill_security_auditor script on a local skill directory or remote git URL to generate a structured audit report with a PASS/WARN/FAIL verdict and remediation guidance.

Frequently Asked Questions about skill-security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan AI agent skills for security vulnerabilities before installing them?▼

To scan AI agent skills for security vulnerabilities, statically analyze the skill directory or remote git repository to detect code execution risks, prompt injection, and filesystem boundary violations, producing a structured PASS/WARN/FAIL audit report with remediation guidance.

What is prompt injection detection in SKILL.md files?▼

Prompt injection detection in SKILL.md files is the process of scanning markdown references to find override directives, hidden characters, and exfiltration instructions that could manipulate AI agent behavior or compromise system security.

Can I use static analysis to detect supply-chain risks in Python and JavaScript dependencies?▼

Yes, static analysis can detect supply-chain risks in Python and JavaScript dependencies by scanning requirements, pyproject.toml, and package.json files to identify typosquatting and unpinned versions that pose security threats.

Does the security audit support CI pipeline gating for third-party skill marketplaces?▼

Yes, the security audit supports CI pipeline gating by generating structured PASS/WARN/FAIL reports with categorized findings, allowing platform operators to automatically block risky skills and reject submissions with critical vulnerabilities.

What are the limitations of static code scanning for AI agent skill security?▼

Static code scanning limitations include detecting only known patterns like eval/exec, shell injection, raw sockets, and obfuscation in Python, shell, and JavaScript files, meaning novel or dynamically generated malicious code may not be identified.

Related Skills

Explore More Software Engineering Skills→
micaelmaltamicaelmalta
1

dependencies

Automate dependency upgrades and lockfile synchronization across Node, Python, Go, Rust, and Ruby projects.

Community
Intermediate
Patasse97Patasse97

skill-security-auditor

Audit AI agent skills for security and generate a verdict report.

Community
Advanced
dandudzidandudzi
2

sast-configuration

Automate SAST tool selection, configuration, and CI/CD integration.

Community
Advanced
Zhow01Zhow01
52

moltguard

Detect and block unsafe prompts and secret leakage in OpenClaw deployments.

Community
Intermediate