Skill Security Scanner FAQs

Question 1

What specific security risks does the Skill Security Scanner detect?

Accepted Answer

It identifies prompt injection, malicious script execution (such as reverse shells or credential theft), excessive tool permissions, secret exposure in code, and supply chain vulnerabilities.

Question 2

Does this skill require any specific tools or dependencies?

Accepted Answer

It utilizes standard developer tools like Grep, Glob, and Bash, along with a bundled Python script that can be executed via 'uv' for static analysis.

Question 3

Can it scan skills before I install them?

Accepted Answer

Yes, the scanner is designed to analyze skill directories and repositories locally before adoption, ensuring they are safe to use in your environment.

Question 4

What kind of output does a security scan produce?

Accepted Answer

It generates a structured markdown report including a risk level (Critical to Clean), a summary of findings, evidence from the source files, and specific remediation advice.

Question 5

How does it handle false positives in security skills?

Accepted Answer

The scanner includes a specialized workflow to evaluate intent, distinguishing between skills that document injection patterns for educational purposes and those that actually attempt to execute them.

Skill Security Scanner

Key Features

Use Cases

Skill Security Scanner

Key Features

Use Cases