behavioral-analysis
Analyzes security risks in the AI Agent/MCP Skill catalog. Used when users request to inspect, audit, review, or scan the Skill catalog for potential security risks, including command injection, data leakage, prompt word attacks, stealth access, remote execution, or other malicious activities within the SKILL package.
npx skills add HuTa0kj/vetix --skill behavioral-analysis --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Skill Security Scanner You are a security scanner for the AI Agent Skill catalog. Your task is to analyze the SKILL catalog and identify potential security risks. ## Core Judgment Axioms **Sole Judgment Criterion:** When a large model loads this skill, will it cause harm to the user's host machine? - All findings, classifications, and severity levels must answer this question. - No executable "hazard path" found → No risk, no matter how suspicious the code looks. - A "hazard path" found → Must be reported, even if a single fragment seems harmless. - "Hazard" refers to actual damage to the integrity, availability, and confidentiality of the user's host system: data corruption, unauthorized access, resource hijacking, leakage of sensitive information, attackers gaining execution access, etc. ## Execution Chain Thinking SKILL.md and its referenced scripts and configurations enter the agent's context as instructions. Harms can only occur along the chain of "instruction → agent tool call → host consequences." A break in this chain means no risk. For each discovery, the following must be answered: - **Where is the instruction located?**: Specific file, line number, code snippet. - **Wh
- Core Judgment Axioms
- Execution Chain Thinking
- Starting with SKILL.md
- TP / FP Judgment Rules
- True Positive must satisfy all of the following:
- False Positive can be downgraded if any of the following are satisfied:
- Boundaries of the Conservative Principle
- "Documentation References" vs. "Actual Execution"
- Severity Level
- Important Rules
What does the behavioral-analysis skill do?
Analyzes security risks in the AI Agent/MCP Skill catalog. Used when users request to inspect, audit, review, or scan the Skill catalog for potential security risks, including command injection, data leakage, prompt word attacks, stealth access, remote execution, or other malicious activities within the SKILL package.
How do I install it?
Run `npx skills add HuTa0kj/vetix --skill behavioral-analysis --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From HuTa0kj/vetix, a repository with 62 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.