Audit Skills safeguards development workflows by inspecting SKILL.md files for dangerous bash execution patterns, prompt injection phrases, unexpected credential access, and scope violations outside project boundaries. It verifies that a skill's actual instructions match its declared frontmatter description and establishes cryptographic provenance baselines (SHA-256) for third-party or adopted skills to flag silent modifications. Designed intentionally to never auto-fix or auto-trust code, this tool delivers clear, structured vulnerability reports so teams can safely evaluate agent capabilities before execution.
主要功能
011 GitHub stars
02Tracks SHA-256 provenance baselines to alert when adopted external skills have mutated
03Scans for high-risk bash commands like credential access, obfuscated strings, and unauthorized curls
04Categorizes findings into standardized BLOCK, REVIEW, and INFO severity tiers
05Detects prompt-injection language designed to manipulate agent execution or bypass user oversight
06Identifies description-vs-behavior mismatches and out-of-scope system modifications
使用场景
01Running scheduled CI or pre-commit security sweeps across internal skill directories
02Detecting silent drift or unauthorized changes in adopted agent instructions
03Vetting community or third-party Claude Code skills before running them in a local environment