skills-security-check

Name: skills-security-check
Availability: InStock
Author: tugoukezhang

Analyze SKILL.md and related files to detect security risks and return P0/P1/P2 assessments.

8|1|Updated Apr 13, 2026

Search Tags:#security #auditing #risk-assessment #static-analysis #supply-chain #skill #prompt-injection

Ready to run

npx skills add https://github.com/Tugoukezhang/workbuddy-skills --skill skills-security-check

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: skills-security-check
Source: https://github.com/Tugoukezhang/workbuddy-skills/tree/main/skills/skills-security-check
Command: npx skills add https://github.com/Tugoukezhang/workbuddy-skills --skill skills-security-check

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security-audit Skill units by performing static analysis of their SKILL.md and related files to identify malicious, dangerous, or risky behavior before deployment.

Core Features & Use Cases

Static analysis of SKILL.md and accompanying documentation to detect prompt injection, data exfiltration, and unsafe dependencies.
Comprehensive risk assessment with clear categorizations (P0, P1, P2) and actionable mitigations for Skill creators and reviewers.
Use Case: Teams can routinely audit new Skills added to their catalog to prevent supply-chain risks and reduce runtime attack surfaces.

Quick Start

Provide a static audit of the target skill by feeding its skill.md and related files to the auditor.

Frequently Asked Questions about skills-security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a Skill pack for prompt injection and data exfiltration risks?▼

Static analysis of SKILL.md and related files detects prompt injection and data exfiltration risks in a Skill pack. It scans scripts, references, and assets directories to return a structured risk assessment with categorized findings and recommended mitigations.

What is static analysis for Skill supply-chain security?▼

Static analysis for Skill supply-chain security examines SKILL.md and accompanying files to detect malicious behavior before deployment. It identifies unsafe dependencies and runtime attack surfaces to prevent supply-chain risks in newly added catalog items.

How do I get a structured risk assessment with P0, P1, and P2 levels for my scripts?▼

Feeding your skill.md and related files to an automated safety auditor generates a structured risk assessment with P0, P1, and P2 levels. The auditor applies static analysis to categorize per-item findings and output recommended mitigations.

Can I routinely audit new Skills added to our catalog to prevent malicious scripts?▼

You can routinely audit new Skills added to your catalog to prevent malicious scripts and reduce runtime attack surfaces. Static analysis evaluates unsafe dependencies across scripts, references, and assets directories to ensure deployment safety.

Does the security auditing process require any external dependencies to run?▼

The security auditing process requires no external dependencies to run. It operates independently by applying static analysis directly to the provided SKILL.md and related files to detect data exfiltration and prompt injection risks.