Agent skill · security · borghei
skill-security-auditor
Security audit and vulnerability scanning for AI agent skills before install. Detects prompt injection, dangerous code, exfiltration, credential harvesting, and supply chain risks. Use when evaluating untrusted skills or gating installs.
Why this skill is useful
Adds executable scripts for comprehensive security auditing of AI agent skills, detecting vulnerabilities that the AI cannot identify on its own.
What it needs
Requires python installed locally. About 3k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
Skill Security Auditor Scan and audit AI agent skills for security risks before installation. Performs static analysis on code files for dangerous patterns, scans markdown files for prompt injection, validates dependency supply chains, checks file system boundaries, and detects obfuscation. Produces a structured PASS / WARN / FAIL verdict with findings categorized by severity and actionable remediation guidance. Keywords: skill security, AI security, prompt injection, code audit, supply chain, dependency scanning, data exfiltration, credential harvesting, obfuscation detection, pre-install security Core Capabilities Code execution risk detection — command injection (os.system, subprocess shell=True, backticks), eval/exec/compile, obfuscation (base64/hex/chr()), network exfiltration, credential harvesting (~/.ssh, ~/.aws), privilege escalation. Prompt injection detection — system-prompt overrides, role hijacking, safety bypass, hidden zero-width/HTML-comment instructions, data-extraction directives, excessive-permission requests. Supply chain analysis — known-vulnerable pins, typosquatting, unpinned versions, inline pip/npm install, low-reputation packages. File system & structure validation — out-of-scope paths, hidden/credential files, unexpected binaries, escaping symlinks, oversized payloads. Verdict & reporting — PASS / WARN / FAIL with severity-categorized findings, remediation, and a strict mode for CI gates. When to Use Evaluating a skill from an untrusted source before installation Pre-install security gate for CI/CD pipelines Auditing a skill directory or git repository for malicious code Reviewing skills before adding them to a team's approved list Post-incident scanning of installed skills Clarify First Before the audit, confirm these inputs. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/skill-security-auditor