skill-security-scanner

To scan AI agent skills for prompt injection and credential exposure, run a static analysis scanner over the skill directory. It identifies hardcoded credentials, malicious code patterns, and data exfiltration risks, outputting severity-rated findings with actionable remediation guidance.

Before deploying an external AI skill, look for prompt injection, hardcoded credentials, remote code execution, and data exfiltration vulnerabilities. Scanning ensures the skill does not contain malicious code or expose sensitive information before integration into your environment.

Static analysis scanning works with skills designed for Claude, Copilot CLI, and Gemini. The scanner supports both Python and JavaScript runtimes to comprehensively analyze multi-runtime skills for security risks.

To check a new skill for remote code execution risks, run a security scan on the skill path. The scanner performs static analysis to detect malicious code patterns and outputs severity-rated findings to help you remediate the identified risks.

The best way to audit AI skills for data exfiltration risks is to run a comprehensive static analysis scanner. It checks Python and JavaScript runtimes, identifying malicious code patterns and providing severity-rated findings with actionable remediation guidance.