Can I use this to audit my own custom skills?

Absolutely. It is designed to validate both internal and third-party skills to ensure they align with security best practices before deployment.

Does it require specific environment tools?

Yes, it utilizes 'uv' to execute its bundled Python static analysis scripts for deterministic pattern matching.

What does the Skill Security Scanner actually check for?

It checks for prompt injection, malicious scripts, secret exposure, excessive tool permissions, and supply chain risks within Claude Code skill directories.

How are the risk levels determined?

Risks are categorized from Low to Critical based on the severity of findings, such as high-confidence credential theft vs. minor best-practice violations.

Skill Security Scanner

Name: Skill Security Scanner
Author: getsentry

bygetsentry

•

338

•

Security & Testing

Scans Claude Code skills for security vulnerabilities including prompt injection, malicious scripts, and excessive permissions.

The Skill Security Scanner is a specialized auditing tool designed to evaluate the safety of Claude Code skills before they are adopted. Developed by the Sentry team, it combines automated static analysis with structured workflows to detect high-risk patterns such as prompt injection, credential theft, and unauthorized data exfiltration. It helps developers maintain a secure development environment by validating skill instructions, script behaviors, and permission requests against a known database of dangerous patterns and supply chain risks.

Key Features

01Detection of prompt injection and behavioral jailbreaks

02338 GitHub stars

03Identification of malicious code, reverse shells, and exfiltration

04Supply chain assessment for untrusted URLs and dependencies

05Automated static analysis of SKILL.md and bundled scripts

06Permission analysis to enforce least-privilege principles

Use Cases

01Identifying excessive tool permissions in custom agent skills

02Auditing internal development skills for security compliance

03Reviewing third-party Claude Code skills before installation

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add getsentry/skills skill-scanner

For use in Claude.ai and ChatGPT

Download Skill