| name | skill-security |
| description | Security scan for Claude Code skills using SkillSpector. Detects 64 vulnerability patterns — prompt injection, data exfiltration, MCP tool poisoning, supply chain, taint tracking, and more — before a skill is installed. Requires Python 3.12+ with `pip install skillspector`, or Docker as a fallback. |
| user-invocable | true |
| model | sonnet |
| context | fork |
| allowed-tools | Read Glob Grep Bash |
| effort | medium |
| argument-hint | ["<path>|--llm"] |
Scope: scan a skill package (SKILL.md + any associated scripts) for security vulnerabilities before installation. Covers 64 patterns across 16 categories using SkillSpector (NVIDIA, Apache 2.0).
Out of scope: application security audits (use /security-audit instead), scanning the project's own source code, fixing identified vulnerabilities.
Do NOT modify any file during the scan.
Step 0 — Preflight: verify SkillSpector availability
Check availability in this order and announce which execution path will be used:
Path A — SkillSpector (pip)
python3 --version 2>&1 | head -1
pip show skillspector 2>&1 | grep -E "^(Name|Version):"
If both return successfully (Python 3.12+ AND skillspector installed): proceed with Path A. Announce: Using SkillSpector [version] via pip.
Path B — Docker fallback
If Path A is not available:
docker --version 2>&1 | head -1
docker image ls skillspector 2>&1 | grep -c skillspector
If Docker is available: instruct the user to build the image if not already built:
Docker image not found. Build it with:
git clone https://github.com/NVIDIA/skillspector.git /tmp/skillspector
docker build -t skillspector /tmp/skillspector
Then re-run this skill.
If the image exists: proceed with Path B. Announce: Using SkillSpector via Docker.
Neither available
If neither Path A nor Path B is usable, stop and output:
SkillSpector is not available. Install it with one of:
pip install skillspector # requires Python 3.12+
pipx install skillspector # isolated install
Or build the Docker image:
git clone https://github.com/NVIDIA/skillspector.git /tmp/skillspector
docker build -t skillspector /tmp/skillspector
Then re-run: /skill-security [path]
Do not proceed further.
Step 1 — Resolve scan target
Parse $ARGUMENTS for a path and the --llm flag.
| Argument pattern | Scan target | LLM mode |
|---|
| (none) | Current directory (.) | disabled |
./path/to/skill/ | Specified directory | disabled |
./SKILL.md | Specified file | disabled |
--llm | Current directory | enabled |
./path/to/skill/ --llm | Specified directory | enabled |
After resolving the path, verify it exists:
ls -la <resolved_path> 2>&1 | head -5
If the path does not exist: stop with Target not found: <path>. Pass a valid skill directory or SKILL.md file.
Announce: Scanning: <resolved_path> | LLM analysis: [enabled|disabled]
Step 2 — Execute static scan
Run the static scan (no LLM) using the available execution path. Capture JSON output for structured parsing.
Path A (pip)
skillspector scan <resolved_path> --no-llm --format json 2>&1
Path B (Docker)
docker run --rm -v "$PWD:/scan" skillspector scan <resolved_path> --no-llm --format json 2>&1
If the command exits with code 2 (error): report the stderr output and stop. A code 1 means risk_score > 50 and is expected — do not treat it as an error.
Store the JSON output for Step 4 parsing.
Step 3 — LLM analysis (opt-in)
Only run this step if --llm was passed in $ARGUMENTS.
Check if an LLM provider credential is available:
echo ${ANTHROPIC_API_KEY:+set} ${OPENAI_API_KEY:+set} 2>/dev/null
If ANTHROPIC_API_KEY is set:
SKILLSPECTOR_PROVIDER=anthropic skillspector scan <resolved_path> --format json 2>&1
If OPENAI_API_KEY is set (and no Anthropic key):
SKILLSPECTOR_PROVIDER=openai skillspector scan <resolved_path> --format json 2>&1
If no key is found: output a warning and proceed with the static-only results from Step 2:
⚠ --llm requested but no API key found.
Set ANTHROPIC_API_KEY or OPENAI_API_KEY and re-run to enable semantic analysis.
Showing static-only results (precision may be lower).
Replace the Step 2 JSON output with the LLM-enhanced JSON if the LLM scan succeeded.
Step 4 — Present report
Parse the JSON output and present the report in this format. Use the actual values from the JSON fields risk_score, risk_severity, risk_recommendation, and filtered_findings (or findings if filtered_findings is absent).
## Skill Security Report
Skill: <basename of resolved_path>
Source: <resolved_path>
Analysis: [Static only | Static + LLM (claude-opus-4-6)]
Risk Score: <risk_score>/100
Severity: <risk_severity>
Verdict: <risk_recommendation>
Severity badge
| risk_severity | Display |
|---|
| LOW | ✅ LOW — SAFE TO INSTALL |
| MEDIUM | ⚠️ MEDIUM — REVIEW BEFORE INSTALLING |
| HIGH | 🔴 HIGH — DO NOT INSTALL |
| CRITICAL | 🚨 CRITICAL — DO NOT INSTALL |
Findings (group by severity: CRITICAL → HIGH → MEDIUM → LOW)
For each finding in the JSON array, output:
[SEVERITY] <rule_id> — <message>
Location: <file>:<start_line>
Confidence: <confidence as percentage>%
Finding: <finding (matched snippet, if present)>
Explanation: <explanation>
Remediation: <remediation>
If there are zero findings: output No security issues detected.
Score breakdown
Explain the score only when risk_score > 0:
Score breakdown:
CRITICAL issues × 50pts: <count>
HIGH issues × 25pts: <count>
MEDIUM issues × 10pts: <count>
LOW issues × 5pts: <count>
Script multiplier (1.3×): [applied|not applied]
Closing
If risk_recommendation is DO NOT INSTALL:
⛔ This skill has a risk score of <risk_score>/100 and should NOT be installed.
Address all CRITICAL and HIGH findings before using it.
If risk_recommendation is CAUTION:
⚠️ Review the findings above before installing this skill.
Run with --llm for deeper semantic analysis (reduces false positives to ~13%).
If risk_recommendation is SAFE:
✅ This skill passed the security scan. Safe to install.
Tip: run with --llm for semantic analysis if the skill includes executable code.
