# Skill Sentry

> Local, static, explainable pre-install security audit for Agent Skills. Scans a third-party Skill's SKILL.md, scripts, config, and manifest to produce a risk report (destructive commands, hidden network calls, secret reads, obfuscation, prompt injection, persistence) so you can decide whether to install it. Use when the user says "audit this Skill before installing", "check this plugin for risks", "scan an Agent Skill for prompt injection", or "is this Skill safe to add". Never executes the scanned code and never uploads it.

- Skill: `whaojie797-design/skill-sentry` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add whaojie797-design/skill-sentry`
- Raw SKILL.md: https://api.skillmd.com/api/skills/whaojie797-design/skill-sentry/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: whaojie797-design (https://skillmd.com/u/whaojie797-design)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/whaojie797-design/skill-sentry

---


# skill-sentry

Read a Skill before it reads your machine.

## What it does

`skill-sentry` is a **static, local, explainable** audit for Agent Skills. It
never runs the scanned Skill and never sends anything anywhere. It reports:

- destructive commands and broad deletes (DEST)
- hidden network requests and download-and-execute pipes (NET)
- secret / credential reads and environment collection (SECRET)
- Base64 / eval / exec / reflection obfuscation (OBF)
- instruction injection and concealment instructions (INJ)
- persistence and privilege-surface changes (PERSIST)
- writes outside the project tree (FS)
- referenced external domains (DOMAIN)

Every hit shows `file:line`, a `rule_id`, a reason, a confidence, and a level
(INFO / REVIEW / HIGH). Heuristic hits are **not** the same as confirmed
vulnerabilities — HIGH hits require human review.

## When to use

- "Audit this Skill before installing"
- "Check this plugin for risks"
- "Scan an Agent Skill for prompt injection"
- "Is this Skill safe to add to my agent?"

## How to run

```bash
python scripts/audit_skill.py <skill-directory>
# optional policy gate for CI:
python scripts/audit_skill.py <skill-directory> --policy policy.yml --out build/
```

Outputs (in the skill directory, or `--out`):

- `SKILL_AUDIT.md` — human-readable report
- `skill-sbom.json` — files, scripts, domains, permission surface
- `policy-result.json` — CI-friendly pass/fail

## Supported hosts

Agent Skills directory format for Codex, Claude Code, Cursor, and Gemini CLI.
The audit itself is a standalone Python CLI — no host required to run it.

## Reference

- `references/rule-catalog.md` — every rule ID and what it means
- `references/false-positive-playbook.md` — how to read and triage hits
- `assets/policy.example.yml` — team policy template