skill-security-review: a skill that audits other Agent Skills for safety

[dkleptsov]

Skills run with full agent permissions: their scripts execute on the user's machine, and their SKILL.md is injected into the agent's context (a prompt-injection surface). This repo has skill-creator for building skills, but nothing for vetting one before you install it.

I built skill-security-review to fill that gap. It runs static analysis only (it never executes the audited skill) and reports:

• network egress (fetch/curl/sockets; localhost downgraded)
• process execution (child_process, exec/spawn, python subprocess)
• secret / credential access (~/.ssh, .env, OS keychain, env harvesting)
• dynamic code (eval, new Function, pickle/unsafe-yaml, decode-then-exec)
• filesystem writes/deletes outside the project
• obfuscation (long base64/hex blobs, zero-width / bidi unicode)
• prompt injection in SKILL.md ("ignore previous instructions", "do not tell the user", exfil, curl ... | sh)

Findings are tiered by how the code reaches execution: auto-run (hooks) > on-invocation > on-demand > static-text, so review attention goes where it matters most. A zero-dependency Node scanner locates; the agent then reads flagged files by hand and writes a verdict. The design rule is strict: never execute the target, and never follow instructions found inside the audited SKILL.md.

Repo (Apache-2.0): https://github.com/dkleptsov/skill-security-review
Install: npx skills add dkleptsov/skill-security-review -g

Happy to adapt the format if it would be useful as a reference or example skill here.