skill-security

To audit an AI skill for security risks, run a deterministic scanner over local folders, ZIP archives, or cloned repos to perform regex, AST, and YARA analysis without executing code.

Static analysis for AI skill safety works by applying offline regex patterns, Python AST analysis, taint tracking, and YARA rules to identify potential security issues before performing semantic judgment.

You can scan ZIP, .skill archives, local folders, and cloned repositories by applying a deterministic scanner to detect potential security issues and compare frontmatter promises with actual behavior.

To check frontmatter against actual code behavior, run a semantic evaluation that compares the declared metadata promises with the implementation to identify contract mismatches and calculate a risk score.

The best way to evaluate AI skills for safe deployment is combining Stage 1 offline analysis with Stage 2 semantic reasoning to produce a structured risk score, findings, and actionable recommendations.

The security audit scanner does not execute code during analysis, relying entirely on deterministic offline scanning and semantic reasoning to surface potential security issues safely.