skill-scanner

Security scanner for AI agent skills (SKILL.md files and associated scripts). Use when a user wants to audit, scan, or verify the security of any SKILL.md file, skill package, or agent skill before installation. Detects prompt injection, credential exposure, data exfiltration, malicious payloads, suspicious shell commands, remote code execution, and supply-chain risks. Triggers on mentions of "scan skill", "check skill security", "audit skill", "is this skill safe", or when a user shares a SKILL.md file for review.