Can I use this to check a plugin before I install it?

Yes, you can provide a GitHub URL to the scanner to audit a remote repository's content before adding it to your local environment.

What specifically does the Security Scanner look for?

It scans for both malicious software code (backdoors, data exfiltration) and malicious natural language instructions (prompt injections) that could compromise the AI's behavior.

What languages are the security reports available in?

The scanner supports any language for its reports. You can configure the 'report_language' setting in your configuration file; it defaults to Japanese (ja) but can be set to English (en), French (fr), etc.

How do I prevent the scanner from flagging my own trusted code?

You can create a 'security-scanner.local.md' file at the user or project level to define trusted marketplaces, plugins, and skills that should be skipped during scans.

Does it support agents other than Claude Code?

Yes, the scanner is compatible with multiple agent frameworks including Codex, Gemini, and general agents using the Skills.sh directory structure.

Security Scanner

Name: Security Scanner
Author: hiroro-work

byhiroro-work

•

Security & Testing

Audits Claude Code plugins and skills for malicious code and prompt injections using AI-driven semantic analysis.

Security Scanner is a robust auditing utility designed to safeguard your AI coding environment by identifying security risks within installed plugins and skills. Unlike traditional scanners, it employs AI semantic analysis to detect both malicious code execution and dangerous natural language instructions, such as prompt injections. The tool offers comprehensive coverage across multiple agent frameworks including Claude, Codex, and Gemini, allowing users to scan local directories or public GitHub repositories before installation. With customizable trusted sources and multi-language reporting, it provides developers with a transparent and configurable layer of defense against untrusted third-party extensions.

Key Features

0123 GitHub stars

02Configurable trusted sources and marketplaces to reduce false positives

03Multi-agent support including Claude, Codex, Gemini, and Skills.sh

04Localized security reports available in multiple languages

05AI-powered semantic analysis for detecting hidden malicious intent

06Direct scanning of public GitHub repositories via URL

Use Cases

01Scanning project-level skills for prompt injection vulnerabilities

02Auditing third-party plugins for malicious code before integration

03Verifying the security of remote skills directly from GitHub repositories

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add hiroro-work/claude-plugins security-scanner

For use in Claude.ai and ChatGPT

Download Skill