Conectar

Skill Security Auditor

galiakrbygaliakr
•
1
•
Seguridad y Pruebas

Performs heuristic security reviews of Claude Code skill files to detect malicious commands, prompt injections, and scope violations.

Audit Skills safeguards development workflows by inspecting SKILL.md files for dangerous bash execution patterns, prompt injection phrases, unexpected credential access, and scope violations outside project boundaries. It verifies that a skill's actual instructions match its declared frontmatter description and establishes cryptographic provenance baselines (SHA-256) for third-party or adopted skills to flag silent modifications. Designed intentionally to never auto-fix or auto-trust code, this tool delivers clear, structured vulnerability reports so teams can safely evaluate agent capabilities before execution.

Características Principales

011 GitHub stars
02Tracks SHA-256 provenance baselines to alert when adopted external skills have mutated
03Scans for high-risk bash commands like credential access, obfuscated strings, and unauthorized curls
04Categorizes findings into standardized BLOCK, REVIEW, and INFO severity tiers
05Detects prompt-injection language designed to manipulate agent execution or bypass user oversight
06Identifies description-vs-behavior mismatches and out-of-scope system modifications

Casos de Uso

01Running scheduled CI or pre-commit security sweeps across internal skill directories
02Detecting silent drift or unauthorized changes in adopted agent instructions
03Vetting community or third-party Claude Code skills before running them in a local environment