| name | skill-decompile |
| description | Decompile any SKILL.md into deterministic YAML for structural security analysis. Extracts permissions, surfaces, risk signals, and produces a scored verdict. |
| skill_type | tool |
| category | security |
| allowed-tools | Bash(python3:*), Read |
| argument-hint | <skill.md> [--output yaml|json] [--verbose] | --dir <path> [--report] |
Skill Decompile — SKILL.md Security Scanner
Converts freeform SKILL.md files into normalized, machine-auditable YAML structures. Bridges the gap between human-authored skill definitions and deterministic security scanning.
Usage
python3 ~/.agents/skills-db/security/skill-decompile/decompile.py ~/.agents/skills/auth-sniffer/SKILL.md
python3 ~/.agents/skills-db/security/skill-decompile/decompile.py ~/.agents/skills/auth-sniffer/SKILL.md --output json --verbose
python3 ~/.agents/skills-db/security/skill-decompile/decompile.py --dir ~/.agents/skills/ --report
python3 ~/.agents/skills-db/security/skill-decompile/decompile.py --dir ~/.agents/skills/ --output yaml
What It Extracts
| Category | Details |
|---|
| meta | name, description, skill_type, source (local/external) |
| permissions | allowed_tools, requests for bash/write/network/env |
| surfaces | URLs, shell commands, env vars, file paths |
| risk_signals | eval, base64, obfuscation, exfil patterns, prompt injection |
| complexity | line count, code blocks, reference files, decision tree depth |
| verdict | risk_score (0-100), risk_level, specific flags |
Risk Scoring
- 0-20: safe — no concerning patterns
- 21-40: low — minor signals, likely benign
- 41-60: medium — review recommended
- 61-80: high — manual audit required
- 81-100: critical — block until reviewed
When to Use
- Before installing a third-party skill
- Periodic security audit of skill inventory
- CI/CD gate for skill contributions
- Comparing skill versions for permission drift
