BD skill-security-auditor
Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".
Security audit and vulnerability scanner for AI agent skills before installation.
As a process D 43/100 · Unfinished process — weak spots: result and completion, when it triggers, inputs and preconditions
What is at stake
Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
The text contains phrases like "ignore previous instructions" or "you are now…". That is an attempt to hijack the agent: it may break your rules, the system limits or company policy.
An honest skill does not need them: state the role and the rules directly without overriding other instructions. Otherwise catalog scanners and corporate filters will block the listing.
How to improve
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 18
✓ No critical or high findings
Medium and low: 18
-
medium Instruction override
en-fake-system-promptSKILL.md:60Fake system prompt injected into content (documentation of a security skill)| **System prompt override** | "Ignore previous instructions", "You are now..." | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->
security skill -
low Dangerous commands
cmd-eval-dynamicreferences/threat-model.md:51Dynamic code execution from decoded/untrusted input (documentation table row; documentation of a security skill)| Direct exec | `eval()`, `exec()`, `os.system()` | `eval(base…ode("..."))` |tablesecurity skill -
low Dangerous commands
cmd-pipe-to-shellreferences/threat-model.md:55Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation table row; documentation of a security skill)| Pipe-to-shell | `curl ... \| sh` | In setup scripts |
tablesecurity skill -
low Exfiltration
exfil-read-secret-filesreferences/threat-model.md:66Reads credential / secret files (documentation table row; documentation of a security skill)| File read | Access credential files | `open(os.path.expanduser("~/.aws/credentials"))` | <!-- noqa: SEC-AUDITOR -->tablesecurity skill -
low Instruction override
en-ignore-previousreferences/threat-model.md:75Instruction-override phrase ("ignore previous instructions") (documentation table row; documentation of a security skill)| Override | "Ignore previous instructions" | In SKILL.md body | <!-- noqa: SEC-AUDITOR -->
tablesecurity skill -
low Risky intent
intent-offensive-securityreferences/threat-model.md:82Offensive-security / dual-use content (legitimate for authorised testing; review intended use)### T4: Persistence & Privilege Escalation
-
low Dangerous commands
cmd-cron-mentionreferences/threat-model.md:89Mentions editing / listing crontab (documentation table row; documentation of a security skill)| Cron jobs | Schedule recurring execution | `crontab -l; echo "* * * * * ..." \| crontab -` |
tablesecurity skill -
low Dangerous commands
cmd-eval-dynamicreferences/threat-model.md:176Dynamic code execution from decoded/untrusted input (documentation of a security skill)exec(base…ode(_c))
security skill -
low Instruction override
en-fake-system-promptscripts/skill_security_auditor.py:409Fake system prompt injected into content (code comment; documentation of a security skill)# System prompt override — CRITICAL
commentsecurity skill -
low Risky intent
intent-offensive-securitySKILL.md:48Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| **Credential harvesting** | reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction patterns | 🔴 CRITICAL |
-
low Dangerous commands
cmd-privilegeSKILL.md:50Privilege escalation / world-writable permissions (documentation table row; documentation of a security skill)| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |
tablesecurity skill -
low Risky intent
intent-offensive-securitySKILL.md:50Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| **Privilege escalation** | `sudo`, `chmod 777`, `setuid`, cron manipulation | 🔴 CRITICAL |
-
low Instruction override
en-ignore-previousSKILL.md:60Instruction-override phrase ("ignore previous instructions") (documentation table row; documentation of a security skill)| **System prompt override** | "Ignore previous instructions", "You are now..." | 🔴 CRITICAL | <!-- noqa: SEC-AUDITOR -->
tablesecurity skill
A further 5 matches are quotations in this security skill's documentation and are not counted as findings.
Files scanned: 3. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
✓ No remarks against the Agent Skills spec
Process rating: all ten parameters 43/100
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 0Failures and branches. Linear process with no failure handling
- 0Progress reporting. Says nothing while it works
- 20When it triggers. No condition that starts the skill
- 30Running it twice. 1 mutating operations with no state check
- 60Tools and files. Uses tools (bash, python, node) that frontmatter does not declare
- 100Steps. 12 steps
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 1699 tokens
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +4Description does not say when NOT to use the skill (false activations)
- +3Output format is not stated: the model decides each time
- -228 emoji in the instructions: noise for the model
- +1No license
- +2Single-language instructions
- +5Description quotes 6 example trigger phrases
- +3Description length 722: enough signal without eating the budget
- +4Structure: 15 headings
- +3Step-by-step instructions: 12 items
- +4Has examples (5 code blocks)
- +4Reference files are cited in the instructions (1 of 1)
- +3All 1 scripts are documented
Quality base 70; lint remarks subtract, signals add up to 100. Result: 94.