skill-safety-audit - SKILL.md Agent Skill

name: skill-safety-audit description: "Audit third-party Agent Skills before installation. Use when the user wants to inspect a Codex, Claude Code, or SKILL.md-based skill, GitHub skill repository, install script, or local skill folder for malicious instructions, secret access, dangerous shell commands, prompt injection, persistence, network exfiltration, or install-time risk."

Skill Safety Audit

Use this skill to audit Agent Skills before installation. It is conservative by default: a REVIEW verdict is acceptable when behavior may be legitimate but needs human inspection. Version 1.1.0 adds Python AST checks, entropy/obfuscation heuristics, dependency risk checks, allowlists, reproducible report metadata, CI exit codes, and Claude Code hook/MCP scanning.

Workflow

Identify the target: local skill folder, single SKILL.md, GitHub repo URL, or GitHub /tree/<ref>/<path> URL.
Do not run any code from the target. Do not execute install scripts, package scripts, hooks, or copied commands.
Run the static auditor:

python scripts/audit_skill.py <target> --format markdown

Useful v1.1 options:

python scripts/audit_skill.py <target> --ref <commit-sha>
python scripts/audit_skill.py <target> --rules ./custom-rules.json
python scripts/audit_skill.py <target> --since v1.0.0
python scripts/audit_skill.py <target> --ignore-file .skillaudit-ignore

Read SKILL_SECURITY_REPORT.md and skill_security_report.json.
Report the verdict first: SAFE, REVIEW, or DANGEROUS, followed by the risk score, exit code, reproducibility metadata, top findings, capability mismatch table, and install recommendation.

Verdict Policy

SAFE: no high or critical findings and low score.
REVIEW: suspicious behavior exists, but the evidence is not enough to reject the skill automatically.
DANGEROUS: critical behavior appears, such as secret access, dangerous shell execution, persistence, or code paths that can exfiltrate data.

CLI exit codes are SAFE=0, REVIEW=1, DANGEROUS=2, and runtime/input error 3.

Never tell the user a skill is safe if the report says REVIEW or DANGEROUS. If the user asks whether to install it, recommend installation only for SAFE; for REVIEW, recommend reading the cited files first; for DANGEROUS, recommend not installing.

Notes

GitHub URL support downloads source only. The auditor must not execute third-party code.
The scanner is static and conservative. It can produce false positives.
expected-capabilities and .skillaudit-ignore can suppress low/medium expected findings, but suppressed findings remain visible in the report.
For a final security decision, combine this report with manual review of the cited files.