skill-security-auditor

To perform a static analysis security audit on an AI agent skill before installation, run the audit script against your local directory or git repository. This evaluates code, prompts, workflows, and dependencies to produce a PASS, WARN, or FAIL verdict.

Yes, you can integrate this pre-install security audit into CI gates and PR reviews. The audit generates machine-readable findings in JSON, Markdown, HTML, or plain text formats, allowing automated pipelines to block deployments based on severity thresholds.

A static analysis security audit checks AI skills by performing a ten-category evaluation across code, prompts, workflows, and dependencies. It reads the SKILL.md frontmatter to derive skill context and surfaces potential security risks before loading.

To handle false positives during an AI skill security audit, you can use baseline suppression and severity flooring features. These allow you to acknowledge known issues and enforce minimum severity levels, ensuring the final verdict remains accurate for CI gates.

Yes, the security audit works with both local directories and git repositories. You can point the audit script to your skill path, and it will read the SKILL.md frontmatter to extract the skill name and description for a comprehensive security evaluation.

Available report formats for AI skill security audit findings include JSON, Markdown, HTML, and plain text. These machine-readable outputs provide structured verdicts and detailed findings suitable for automated CI integration and manual PR reviews.