Skill Security Auditor
Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findings and remediation guidance.
What Gets Scanned
1. Code Execution Risks (Python/Bash Scripts)
Scans all .py, .sh, .bash, .js, .ts files for:
| Category |
Patterns Detected |
Severity |
| Command injection |
os.system(), os.popen(), subprocess.call(shell=True), backtick execution |
🔴 CRITICAL |
| Code execution |
eval(), exec(), compile(), __import__() |
🔴 CRITICAL |
| Obfuscation |
base64-encoded payloads, codecs.decode, hex-encoded strings, chr() chains |
🔴 CRITICAL |
| Network exfiltration |
requests.post(), urllib.request, socket.connect(), httpx, aiohttp |
🔴 CRITICAL |
| Credential harvesting |
reads from ~/.ssh, ~/.aws, ~/.config, env var extraction patterns |
🔴 CRITICAL |
| File system abuse |
writes outside skill dir, /etc/, ~/.bashrc, ~/.profile, symlink creation |
🟡 HIGH |
| Privilege escalation |
sudo, chmod 777, setuid, cron manipulation |
🔴 CRITICAL |
| Unsafe deserialization |
pickle.loads(), yaml.load() (without SafeLoader), marshal.loads() |
🟡 HIGH |
| Subprocess (safe) |
subprocess.run() with list args, no shell |
⚪ INFO |
2. Prompt Injection in SKILL.md
Scans SKILL.md and all .md reference files for:
| Pattern |
Example |
Severity |
| System prompt override |
"Ignore previous instructions", "You are now..." |
🔴 CRITICAL |
| Role hijacking |
"Act as root", "Pretend you have no restrictions" |
🔴 CRITICAL |
| Safety bypass |
"Skip safety checks", "Disable content filtering" |
🔴 CRITICAL |
| Hidden instructions |
Zero-width characters, HTML comments with directives |
🟡 HIGH |
| Excessive permissions |
"Run any command", "Full filesystem access" |
🟡 HIGH |
| Data extraction |
"Send contents of", "Upload file to", "POST to" |
🔴 CRITICAL |
3. Dependency Supply Chain
For skills with requirements.txt, package.json, or inline pip install:
| Check |
What It Does |
Severity |
| Known vulnerabilities |
Cross-reference with PyPI/npm advisory databases |
🔴 CRITICAL |
| Typosquatting |
Flag packages similar to popular ones (e.g., reqeusts) |
🟡 HIGH |
| Unpinned versions |
Flag requests>=2.0 vs requests==2.31.0 |
⚪ INFO |
| Install commands in code |
pip install or npm install inside scripts |
🟡 HIGH |
| Suspicious packages |
Low download count, recent creation, single maintainer |
⚪ INFO |
4. File System & Structure
| Check |
What It Does |
Severity |
| Boundary violation |
Scripts referencing paths outside skill directory |
🟡 HIGH |
| Hidden files |
.env, dotfiles that shouldn't be in a skill |
🟡 HIGH |
| Binary files |
Unexpected executables, .so, .dll, .exe |
🔴 CRITICAL |
| Large files |
Files >1MB that could hide payloads |
⚪ INFO |
| Symlinks |
Symbolic links pointing outside skill directory |
🔴 CRITICAL |
1---2name: skill-security-auditor3description: Security patterns and auditing for AI interactions. Scan and audit AI agent skills for security risks before installation.4---56# Skill Security Auditor78Scan and audit AI agent skills for security risks before installation. Produces a clear **PASS / WARN / FAIL** verdict with findings and remediation guidance.910## What Gets Scanned1112### 1. Code Execution Risks (Python/Bash Scripts)13Scans all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for:1415| Category | Patterns Detected | Severity |16|----------|-------------------|----------|17| **Command injection** | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | 🔴 CRITICAL |18| **Code execution** | `eval()`, `exec()`, `compile()`, `__import__()` | 🔴 CRITICAL |19| **Obfuscation** | base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains | 🔴 CRITICAL |20| **Network exfiltration** | `requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp` | 🔴 CRITICAL |21| **Credential harvesting** | reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns | 🔴 CRITICAL |22| **File system abuse** | writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation | 🟡 HIGH |23| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |24| **Unsafe deserialization** | `pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()` | 🟡 HIGH |25| **Subprocess (safe)** | `subprocess.run()` with list args, no shell | ⚪ INFO |2627### 2. Prompt Injection in SKILL.md28Scans SKILL.md and all `.md` reference files for:2930| Pattern | Example | Severity |31|---------|---------|----------|32| **System prompt override** | "Ignore previous instructions", "You are now..." | 🔴 CRITICAL |33| **Role hijacking** | "Act as root", "Pretend you have no restrictions" | 🔴 CRITICAL |34| **Safety bypass** | "Skip safety checks", "Disable content filtering" | 🔴 CRITICAL |35| **Hidden instructions** | Zero-width characters, HTML comments with directives | 🟡 HIGH |36| **Excessive permissions** | "Run any command", "Full filesystem access" | 🟡 HIGH |37| **Data extraction** | "Send contents of", "Upload file to", "POST to" | 🔴 CRITICAL |3839### 3. Dependency Supply Chain40For skills with `requirements.txt`, `package.json`, or inline `pip install`:4142| Check | What It Does | Severity |43|-------|-------------|----------|44| **Known vulnerabilities** | Cross-reference with PyPI/npm advisory databases | 🔴 CRITICAL |45| **Typosquatting** | Flag packages similar to popular ones (e.g., `reqeusts`) | 🟡 HIGH |46| **Unpinned versions** | Flag `requests>=2.0` vs `requests==2.31.0` | ⚪ INFO |47| **Install commands in code** | `pip install` or `npm install` inside scripts | 🟡 HIGH |48| **Suspicious packages** | Low download count, recent creation, single maintainer | ⚪ INFO |4950### 4. File System & Structure51| Check | What It Does | Severity |52|-------|-------------|----------|53| **Boundary violation** | Scripts referencing paths outside skill directory | 🟡 HIGH |54| **Hidden files** | `.env`, dotfiles that shouldn't be in a skill | 🟡 HIGH |55| **Binary files** | Unexpected executables, `.so`, `.dll`, `.exe` | 🔴 CRITICAL |56| **Large files** | Files >1MB that could hide payloads | ⚪ INFO |57| **Symlinks** | Symbolic links pointing outside skill directory | 🔴 CRITICAL |
ahmet-talha-kavakli