Agent skill · Security

skill-security-auditor

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. "check skill before install", "skill s

Alireza Rezvani23,369★ · +428/wk · 1 repos on radarProfile →
claude-codecodexcursorships scriptsMIT
Install
npx skills add alirezarezvani/claude-skills --skill skill-security-auditor --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

Facts
Files in the skill folder: 3
SKILL.md size: 7 KB
Bundled scripts: yes
Path: engineering/skills/skill-security-auditor/SKILL.md
Open the folder on GitHub →
Where it comes from
Stars: 23,791 · +422 this week
Language: Python
Read our review of the source →

Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.

From the SKILL.md

# Skill Security Auditor Scan and audit AI agent skills for security risks before installation. Produces a clear **PASS / WARN / FAIL** verdict with findings and remediation guidance. ## Quick Start ```bash # Audit a local skill directory python3 scripts/skill_security_auditor.py /path/to/skill-name/ # Audit a skill from a git repo python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name # Audit with strict mode (any WARN becomes FAIL) python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict # Output JSON report python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json ``` ## What Gets Scanned ### 1. Code Execution Risks (Python/Bash Scripts) Scans all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for: | Category | Patterns Detected | Severity | |----------|-------------------|----------| | **Command injection** | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | 🔴 CRITICAL | | **Code execution** | `eval()`, `exec()`, `compile()`, `__import__()` | 🔴 CRITICAL | | **Obfuscation** | base64-encoded payloads, `codecs.decode`, hex-encoded strings, `chr()` chains | 🔴 CRITICAL | | **Network exfiltrati

What's inside
Steps it walks through
  1. Quick Start
  2. What Gets Scanned
  3. 1. Code Execution Risks (Python/Bash Scripts)
  4. 2. Prompt Injection in SKILL.md
  5. 3. Dependency Supply Chain
  6. 4. File System & Structure
  7. Audit Workflow
  8. Reading the Report
  9. Advanced Usage
  10. Audit a Skill from Git Before Cloning
  11. CI/CD Integration
  12. Batch Audit
  13. Threat Model Reference
  14. Limitations
Ships with 2 files
  • references/threat-model.md
  • scripts/skill_security_auditor.py
Commands it runs
Audit a local skill directory
python3 scripts/skill_security_auditor.py /path/to/skill-name/
Audit a skill from a git repo
python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name
Audit with strict mode (any WARN becomes FAIL)
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict
Output JSON report
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json
Clone to temp dir, audit, then clean up
python3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup
More from claude-skills
All skills →
signup-flow-croWhen the user wants to optimize signup, registration, account creation, or trial activation flows.…Design & Presentationstrategic-alignmentCascades strategy from boardroom to individual contributor. Detects and fixes misalignment between…Otherprocess-mapperUse when a BizOps lead, COO, or process-improvement owner needs to document an end-to-end business…Design & Presentationsaas-scaffolderGenerates complete, production-ready SaaS project boilerplate including authentication, database…Securitysecrets-vault-managerUse when the user asks to set up secret management infrastructure, integrate HashiCorp Vault…Securityab-test-setupWhen the user wants to plan, design, or implement an A/B test or experiment. Also use when the user…Testing & QA
About this skill
What does the skill-security-auditor skill do?

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. "check skill before install", "skill s

How do I install it?

Run `npx skills add alirezarezvani/claude-skills --skill skill-security-auditor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.

Where does this skill come from?

From alirezarezvani/claude-skills, a repository with 23,791 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.

Is a popular skill a good skill?

Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.

Keep going
All skills →
The full catalog, by category and by tool.
Open Source Radar →
The repositories these skills come from, watched daily.
The people behind them →
Makers and builders across the ecosystem.