Agent skill · security · sundial-org
skills-audit
Audit locally installed agent skills for security/policy issues using the SkillLens CLI (`skilllens scan`, `skilllens config`). Use when asked to scan a skills directory (Codex/Claude) and produce a risk-focused audit report based on each skill's `SKILL.md` and bundled resources.
Why this skill is useful
Provides a detailed audit workflow and risk evaluation criteria for assessing agent skills, which the AI wouldn't reliably generate on its own.
What it needs
Requires skilllens installed locally. About 2k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
Skills Audit (SkillLens) Install SkillLens One-off run: npx skilllens scan (or pnpm dlx skilllens scan) Global install: pnpm add -g skilllens Quick start Run skilllens config to see configured scan roots and auditor CLI availability. Run skilllens scan to scan configured roots, or skilllens scan <path> to scan a specific directory. Re-run with --verbose to see raw auditor output and --force to ignore cached results. Audit workflow 1. Define scope Prefer a concrete target path (example: ~/.codex/skills) unless the user explicitly wants all configured roots. If auditing a repo checkout containing skills, scan the parent folder that contains skill directories (example: skilllens scan ./skills). 2. Inventory skills with SkillLens Run skilllens scan [path] [--auditor claude codex]. Treat missing auditor CLIs or skipped statuses as “manual review required”, not “safe”. 3. Prioritize review order Review any unsafe or suspicious verdicts first. Next, review skills that request broad permissions (filesystem/network), run shell commands, or reference external downloads. 4. Manually review each skill’s contents Read the skill’s SKILL.md and any referenced scripts/, references/, and assets/. Do not execute bundled scripts by default; inspect first. 5. Evaluate risks (focus on realistic abuse) Exfiltration: sending file contents, env vars, tokens, SSH keys, browser data, or configs to remote endpoints. Execution: instructions to run arbitrary shell commands, curl bash, eval, or to fetch-and-execute code. Persistence: modifying shell profiles, launch agents, cron, editor configs, or skill install locations. Privilege/approval bypass: instructions to ignore system policies, disable safety checks, or request escalated permissions unnecessarily. Prompt injection: attempts to override higher-priority instructions (“ignore previous”, “always comply”, “never mention…”). Overbroad triggers: vague descriptions that cause the skill to trigger on unrelated tasks. 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/skills-audit