菜单
Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Automated security auditing for AI agent code. Scans repos, packages, MCP servers, and installed skills for malicious patterns using eight-phase analysis: install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance, prompt injection, and skill security. Use when: cloning repos, installing packages, reviewing MCP servers, auditing skills, scanning code before execution, or when asked to check if something is safe, audit code, scan for malware, review dependencies.
Act as a brutally honest McKinsey-level strategy consultant to diagnose the real underlying problems hurting a business's growth, profitability, or traction. Use this skill whenever someone asks to diagnose their business, wants honest feedback on why their business isn't growing, says things like 'what's wrong with my business', 'why isn't this working', 'roast my startup', 'tear apart my business', 'honest assessment', 'brutal feedback', 'diagnose my company', or asks for a strategy consultant perspective. Also trigger when users share a business description and ask what's holding them back.
Identify a founder's biggest blind spots — flawed assumptions, strategic misjudgments, and decisions that feel right but are damaging the business long-term. Use this skill whenever someone asks about their blind spots, wants to know what they're missing, says things like 'what am I not seeing', 'where am I wrong', 'challenge my assumptions', 'play devil's advocate on my business', 'what would I regret in 2 years', 'poke holes in my strategy', or asks for a fresh perspective from someone who's seen startups fail. Also trigger when a founder seems very confident and asks for feedback — confidence is often where blind spots hide.
Identify the single biggest bottleneck preventing faster business growth by examining the offer, audience targeting, distribution channels, messaging, pricing, and funnel structure. Use this skill whenever someone asks why they aren't growing faster, wants to find their growth bottleneck, says things like 'what's limiting our growth', 'why are we stuck', 'we've plateaued', 'growth has stalled', 'how do we grow faster', 'what's the constraint', 'find the bottleneck', 'why aren't we scaling', or describes a business that should be growing but isn't. Also trigger when a founder shares decent traction but frustration about pace.
Evaluate a business idea or offer through the lens of real market demand — is the problem truly painful, the solution compelling, and the positioning differentiated? Use this skill whenever someone asks for a market reality check, wants to validate a business idea, says things like 'is there a market for this', 'will people pay for this', 'is my idea viable', 'validate my concept', 'is this a real problem', 'market validation', 'demand check', 'would you buy this', or shares a new business concept and wants honest market feedback. Also trigger when someone is about to invest significant time or money into an unvalidated idea.
Analyze a product or service offer with ruthless objectivity to determine if the value proposition is strong enough to drive real demand. Use this skill whenever someone asks to evaluate their offer, test their value proposition, says things like 'is my offer good enough', 'rate my offer', 'test my pricing', 'is this compelling', 'would you buy this', 'critique my product', 'evaluate my service', 'offer teardown', 'value prop test', 'is my pricing right', or shares a product/service and wants to know if it will sell. Also trigger when someone is about to launch a new offer, restructuring their pricing, or struggling with low conversion rates that may be offer-related.
| name | scan-package |
| description | Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands. |
| allowed-tools | Bash(./bin/sigil *) |
Scan a package before installation:
./bin/sigil pip <package> for Python packages./bin/sigil npm <package> for Node packagesCritical patterns to flag:
Present findings and guide the user through quarantine approval.