skills.rest
Tugoukezhang
TugoukezhangCOMMUNITY
Explore all skills by this author →
GitHub

skills-security-check

Analyze SKILL.md and related files to detect security risks and return P0/P1/P2 assessments.

8|1|Updated Apr 13, 2026
Search Tags:#security#auditing#risk-assessment#static-analysis#supply-chain#skill#prompt-injection
One-click install
npx skills add https://github.com/Tugoukezhang/workbuddy-skills --skill skills-security-check
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skills-security-check
Source: https://github.com/Tugoukezhang/workbuddy-skills/tree/main/skills/skills-security-check
Command: npx skills add https://github.com/Tugoukezhang/workbuddy-skills --skill skills-security-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security-audit Skill units by performing static analysis of their SKILL.md and related files to identify malicious, dangerous, or risky behavior before deployment.

Core Features & Use Cases

  • Static analysis of SKILL.md and accompanying documentation to detect prompt injection, data exfiltration, and unsafe dependencies.
  • Comprehensive risk assessment with clear categorizations (P0, P1, P2) and actionable mitigations for Skill creators and reviewers.
  • Use Case: Teams can routinely audit new Skills added to their catalog to prevent supply-chain risks and reduce runtime attack surfaces.

Quick Start

Provide a static audit of the target skill by feeding its skill.md and related files to the auditor.

Frequently Asked Questions about skills-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a Skill pack for prompt injection and data exfiltration risks?▼

Static analysis of SKILL.md and related files detects prompt injection and data exfiltration risks in a Skill pack. It scans scripts, references, and assets directories to return a structured risk assessment with categorized findings and recommended mitigations.

What is static analysis for Skill supply-chain security?▼

Static analysis for Skill supply-chain security examines SKILL.md and accompanying files to detect malicious behavior before deployment. It identifies unsafe dependencies and runtime attack surfaces to prevent supply-chain risks in newly added catalog items.

How do I get a structured risk assessment with P0, P1, and P2 levels for my scripts?▼

Feeding your skill.md and related files to an automated safety auditor generates a structured risk assessment with P0, P1, and P2 levels. The auditor applies static analysis to categorize per-item findings and output recommended mitigations.

Can I routinely audit new Skills added to our catalog to prevent malicious scripts?▼

You can routinely audit new Skills added to your catalog to prevent malicious scripts and reduce runtime attack surfaces. Static analysis evaluates unsafe dependencies across scripts, references, and assets directories to ensure deployment safety.

Does the security auditing process require any external dependencies to run?▼

The security auditing process requires no external dependencies to run. It operates independently by applying static analysis directly to the provided SKILL.md and related files to detect data exfiltration and prompt injection risks.

Related Skills

Explore More Software Engineering Skills→
Kilo-OrgKilo-Org
166

skill-creator

Scaffold SKILL.md frontmatter and starter directories for new skills.

Official
Intermediate
adolfoaranaes12adolfoaranaes12
2

risk-profile

Score implementation risks by Probability × Impact across six categories.

Community
Advanced
AribSudiaAribSudia
2

arib-check-deps

Audit project dependencies for security vulnerabilities, license compliance, and supply chain risks.

Community
Advanced
haJ1thaJ1t

agent-shield

Monitor AI agent actions and detect security threats during runtime.

Community
Advanced