skill-security-auditor

npx skills add lawve-ai/awesome-legal-skills --skill skill-security-auditor-lawve --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

# Skill Security Auditor Static analysis for AI agent skills. Run it on any skill from outside your own trust boundary before letting an agent execute its scripts. The auditor walks the entire skill directory and emits findings across ten threat categories, then collapses them into a single verdict that CI can gate on. This skill is paranoid by design. It assumes a skill author may be trying to compromise the host system, exfiltrate credentials, persist beyond the session, or inject hostile instructions into the model. Most skills will trip a couple of LOW or MEDIUM findings — that's expected. The signal worth acting on is CRITICAL and HIGH. ## When to use Trigger this skill when the user: - Is about to install a third-party skill, plugin, or agent extension. - Asks "is this skill safe?", "audit it", "scan it", "is there anything sketchy in here?", or similar pre-install review questions. - Wants a security gate on a skill marketplace, internal skill registry, or CI pipeline that ingests user-submitted skills. - Just cloned a skill repo and wants a one-shot review before running it. Do **not** use this skill when the user is auditing their own first-party code — there are better st

Audit a local directory
python3 scripts/audit.py /path/to/skill
Audit a git repo (cloned to a temp dir, optionally cleaned up after)
python3 scripts/audit.py https://github.com/example/some-skill.git --cleanup
Strict mode — treat HIGH findings as blocking (recommended for CI)
python3 scripts/audit.py ./skill --strict
Machine-readable output for CI
python3 scripts/audit.py ./skill --json --output report.json
Markdown report suitable for pasting into a PR comment
python3 scripts/audit.py ./skill --markdown --output review.md