skill-security-auditor

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: \"audit this skill\", \"is this skill safe\", \"scan skill for security\", \"check skill before install\", \"skill security check\", \"skill vulnerability scan\".

Ir a la instalación

Repositorio: seaworld008/Commonly-used-high-value-skills
Última actividad en el origen: 29 de junio de 2026 a las 03:04
Idioma detectado de SKILL.md: inglés
Estrellas: 64
Forks: 10

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/seaworld008/Commonly-used-high-value-skills --skill skill-security-auditor

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

agent-hub

Multi-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.

2026-07-27

agent-workflow-designer

Design production-grade multi-agent orchestration systems. Covers five core patterns (sequential pipeline, parallel fan-out/fan-in, hierarchical delegation, event-driven, consensus), platform-specific implementations, handoff protocols, state management, error recovery, context window budgeting, and cost optimization.

2026-07-27

app-store-optimization

App Store Optimization toolkit for researching keywords, optimizing metadata, and tracking mobile app performance on Apple App Store and Google Play Store.

2026-07-27

Ver todos los de este repositorio

Skill Security Auditor

Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findings and remediation guidance.

Quick Start

# Audit a local skill directory python3 scripts/skill_security_auditor.py /path/to/skill-name/ # Audit a skill from a git repo python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name # Audit with strict mode (any WARN becomes FAIL) python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict # Output JSON report python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json

What Gets Scanned

1. Code Execution Risks (Python/Bash Scripts)

Scans all .py, .sh, .bash, .js, .ts files for:

name	skill-security-auditor
description	Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: \"audit this skill\", \"is this skill safe\", \"scan skill for security\", \"check skill before install\", \"skill security check\", \"skill vulnerability scan\".
zh_description	用于技能、安全、审计，支持安全扫描、审计、加固和风险治理。
version	1.0.4
author	seaworld008
source	github:alirezarezvani/claude-skills
source_url
license	MIT
tags	["auditor", "security", "skill"]
created_at	2026-03-27
updated_at	2026-06-16
quality	4
complexity	intermediate

Category	Patterns Detected	Severity
Command injection	`os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution	🔴 CRITICAL
Code execution	`eval()`, `exec()`, `compile()`, `__import__()`	🔴 CRITICAL
Obfuscation	base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains	🔴 CRITICAL
Network exfiltration	`requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp`	🔴 CRITICAL
Credential harvesting	reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns	🔴 CRITICAL
File system abuse	writes outside skill dir, `/etc/`, , , symlink creation

name	skill-security-auditor
description	Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: \"audit this skill\", \"is this skill safe\", \"scan skill for security\", \"check skill before install\", \"skill security check\", \"skill vulnerability scan\".
zh_description	用于技能、安全、审计，支持安全扫描、审计、加固和风险治理。
version	1.0.4
author	seaworld008
source	github:alirezarezvani/claude-skills
source_url
license	MIT
tags	["auditor", "security", "skill"]
created_at	2026-03-27
updated_at	2026-06-16
quality	4
complexity	intermediate

Category	Patterns Detected	Severity
Command injection	`os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution	🔴 CRITICAL
Code execution	`eval()`, `exec()`, `compile()`, `__import__()`	🔴 CRITICAL
Obfuscation	base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains	🔴 CRITICAL
Network exfiltration	`requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp`	🔴 CRITICAL
Credential harvesting	reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns	🔴 CRITICAL
File system abuse	writes outside skill dir, `/etc/`, , , symlink creation

Pattern	Example	Severity
System prompt override	"Ignore previous instructions", "You are now..."	🔴 CRITICAL
Role hijacking	"Act as root", "Pretend you have no restrictions"	🔴 CRITICAL
Safety bypass	"Skip safety checks", "Disable content filtering"	🔴 CRITICAL
Hidden instructions	Zero-width characters, HTML comments with directives	🟡 HIGH
Excessive permissions	"Run any command", "Full filesystem access"	🟡 HIGH
Data extraction	"Send contents of", "Upload file to", "POST to"	🔴 CRITICAL

skill-security-auditor

Opciones de instalación

Revisa los archivos de origen