skills-audit

You can audit local agent skills for security and policy risks by running a scan on your skills directory. The scan analyzes each skill's SKILL.md and bundled resources to produce a risk-focused report highlighting unsafe or suspicious items.

A skill security audit report includes risk-focused findings that cite evidence from each skill's SKILL.md and bundled resources. It highlights unsafe permissions, policy gaps, and suspicious items found across all evaluated skills.

Yes, you can scan a Codex or Claude skills directory before deployment. The audit process applies to directories containing these local agent skills and evaluates their bundled scripts, references, and assets for compliance.

To check for unsafe permissions or missing frontmatter, scan the skills directory to evaluate each SKILL.md. The audit ensures each skill provides a name and description in frontmatter and flags any identified policy gaps or risks.

The best way to vet local agent skills for compliance is to run a directory scan that analyzes SKILL.md files and bundled resources. This generates a risk-focused audit report citing evidence of any unsafe or suspicious items.

Yes, the skill audit evaluates bundled scripts and references. During evaluation, it analyzes optional directories containing scripts, references, and assets alongside the SKILL.md to identify potential security and policy risks.