ワンクリックでManusで任意のスキルを実行

skill-vetter

スター4

フォーク1

更新日2026年3月10日 10:03

Security review and audit tool for AI agent skills. Use when asked to "vet a skill", "check skill security", "audit a skill", or when reviewing skills before installation to detect malicious code, unauthorized access, and suspicious patterns.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

b1mango

b1mango/Agent-Skills

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Skill Vetter

Security review and audit tool for AI agent skills. Checks for potential security risks before skill installation.

When to Use

Before installing a new skill from an untrusted source
User asks to "vet" or "audit" a skill
Reviewing skill code for security vulnerabilities
Checking for malicious patterns in skill files

Security Review Process

1. File Analysis

Scan all files in the skill directory:

SKILL.md - Main instruction file
scripts/ - Helper scripts
references/ - Reference documents
Any other included files

2. Check Categories

🔴 Critical Risks

Shell injection: Commands that could execute arbitrary code
File system access: Unauthorized read/write to sensitive paths
Network exfiltration: Sending data to external servers
Credential theft: Accessing API keys, tokens, passwords
Privilege escalation: Commands requiring elevated permissions

🟡 Medium Risks

Broad file permissions: Overly permissive file access patterns
External dependencies: Downloading scripts from URLs at runtime
Environment variable access: Reading sensitive env vars
Hidden obfuscation: Base64 encoded strings, eval statements

🔵 Low Risks

Overly broad instructions: Instructions that could lead to unintended actions
Missing input validation: No checks on user-provided data
Unclear scope: Ambiguous instructions that could be misinterpreted

3. Output Format

## Skill Security Report: [skill-name]

### Risk Level: [LOW/MEDIUM/HIGH/CRITICAL]

### Findings
| # | Severity | File | Description |
|---|----------|------|-------------|
| 1 | 🔴 CRITICAL | script.py:15 | Shell injection via user input |
| 2 | 🟡 MEDIUM | SKILL.md:42 | Broad file access pattern |

### Recommendation
[SAFE TO INSTALL / INSTALL WITH CAUTION / DO NOT INSTALL]

### Details
[Detailed explanation of each finding]

Best Practices

Always vet skills from unknown sources
Review scripts line by line for suspicious patterns
Check for obfuscated code
Verify network access is justified
Ensure file access is scoped appropriately

このリポジトリの他の Skills

同じリポジトリ

code-review-skill

b1mango/Agent-Skills

Compatibility alias for the canonical code-reviewer skill. Use only when older prompts or users explicitly reference code-review-skill; otherwise prefer Agent-Skills/code-reviewer/SKILL.md for code reviews, PR reviews, diffs, staged or unstaged changes, and systematic analysis of correctness, security, performance, maintainability, and tests.

2026-04-264

code-reviewer

b1mango/Agent-Skills

Professional code review workflow for local changes, pull requests, diffs, or pasted code. Use when asked to review code, check PRs, inspect staged or unstaged changes, assess correctness, security, performance, maintainability, tests, or produce actionable findings with severity and file or line references.

2026-04-264

web-access

b1mango/Agent-Skills

所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。触发场景：用户要求搜索信息、查看网页内容、访问需要登录的网站、操作网页界面、抓取社交媒体内容（小红书、微博、推特等）、读取动态渲染页面、以及任何需要真实浏览器环境的网络任务。

2026-03-254

scrapling

b1mango/Agent-Skills

使用 Scrapling 进行高级网页抓取，支持反爬绕过（Cloudflare Turnstile）、隐身浏览、自适应解析、Spider 爬虫框架。适用于被反爬保护的网站、动态内容抓取、批量数据提取等场景。

2026-03-244

geopolitical-deep-analysis

b1mango/Agent-Skills

中文时政地缘政治深度分析写作技能。用于撰写去AI味的、具有杂志长文风格的深度时政分析文章。涵盖去AI化规则、长段叙述规范、分析推理要求和数据引用标准。适用于中东局势、大国博弈、战争分析、国际关系等题材。

2026-03-124

codegen-diagram

b1mango/Agent-Skills

Generate code architecture diagrams from source code. Use when asked to "generate a diagram", "visualize code architecture", "create a class diagram", "draw a sequence diagram", or when converting code into visual Mermaid/PlantUML diagrams.

2026-03-104

Skill Vetter

Security review and audit tool for AI agent skills. Checks for potential security risks before skill installation.

When to Use

Before installing a new skill from an untrusted source

User asks to "vet" or "audit" a skill

Reviewing skill code for security vulnerabilities

Checking for malicious patterns in skill files

Security Review Process

1. File Analysis

Scan all files in the skill directory:

SKILL.md - Main instruction file

scripts/ - Helper scripts

references/ - Reference documents

Any other included files

2. Check Categories

🔴 Critical Risks

Shell injection: Commands that could execute arbitrary code

File system access: Unauthorized read/write to sensitive paths

Network exfiltration: Sending data to external servers

Credential theft: Accessing API keys, tokens, passwords

Privilege escalation: Commands requiring elevated permissions

🟡 Medium Risks

Broad file permissions: Overly permissive file access patterns

External dependencies: Downloading scripts from URLs at runtime

Environment variable access: Reading sensitive env vars

Hidden obfuscation: Base64 encoded strings, eval statements

🔵 Low Risks

Overly broad instructions: Instructions that could lead to unintended actions

Missing input validation: No checks on user-provided data

Unclear scope: Ambiguous instructions that could be misinterpreted

3. Output Format

## Skill Security Report: [skill-name] ### Risk Level: [LOW/MEDIUM/HIGH/CRITICAL] ### Findings | # | Severity | File | Description | |---|----------|------|-------------| | 1 | 🔴 CRITICAL | script.py:15 | Shell injection via user input | | 2 | 🟡 MEDIUM | SKILL.md:42 | Broad file access pattern | ### Recommendation [SAFE TO INSTALL / INSTALL WITH CAUTION / DO NOT INSTALL] ### Details [Detailed explanation of each finding]

Best Practices

Always vet skills from unknown sources

Review scripts line by line for suspicious patterns

Check for obfuscated code

Verify network access is justified

Ensure file access is scoped appropriately

name	skill-vetter
description	Security review and audit tool for AI agent skills. Use when asked to "vet a skill", "check skill security", "audit a skill", or when reviewing skills before installation to detect malicious code, unauthorized access, and suspicious patterns.