skill-safety-audit

name	skill-safety-audit
description	Scan new or updated skills for unsafe or malicious instructions (unknown tools, external installers, credential harvesting) before accepting them into the repository.

Skill Safety Audit

Acknowledgement: Shared by Peter Bamuhigire, techguypeter.com, [phone].

Use when

• The task matches this domain: Scan new or updated skills for unsafe or malicious instructions (unknown tools, external installers, credential harvesting) before accepting them into the repository.
• The user needs evaluation, findings, prioritization, or remediation guidance.

Do not use when

• The user needs direct implementation instead of an audit.
• There is no target artifact or change set to inspect.

Required inputs

• The site, page, skill, or workflow being audited.
• Any business goals, constraints, or supporting evidence available for prioritization.

Workflow

1. Define the audit scope and what success or risk means in context.
2. Inspect the target using the relevant checklist and preserved guidance.
3. Summarize the highest-value findings with clear reasoning.
4. Prioritize remediation so the next actions are obvious.

Quality standards

• Findings must be evidence-based and ordered by impact.
• Recommendations should be specific enough to implement.
• The audit should reduce risk or ambiguity for the next person acting on it.

Anti-patterns

• Do not provide generic checklist output with no prioritization.
• Do not hide high-severity issues in vague language.
• Do not imply certainty when evidence is missing.

Outputs

• Audit report, prioritized findings, remediation notes, or approval status.

References

• Start with references/legacy-guidance.md when you need the preserved detailed instructions from the previous skill version.
• Read only the specific files under references/ that match the current task instead of loading the whole directory.
• This skill has no bundled scripts by default; keep execution focused on the documented workflow and any existing project files.

Notes

• Treat this SKILL.md as the portable execution layer for both Codex and Codex.
• Preserve existing project behavior unless the current task explicitly requires a change.