Individual skill
skill-scanner
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.
skills/skill-scanner/SKILL.md
Source commit 0c464f411bdfb8d4c12314b36264d06cb2f60270
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,136
- Repository last updated
- Nov 5, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- tag-production Repository topic
- security Derived category
- operations Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 9,927 bytesSKILL.mdcore · 9,927 bytesSKILL.mdcore · 9,927 bytesSKILL.mdcore · 9,927 bytesSKILL.mdcore · 9,927 bytesreferences/dangerous-code-patterns.mddoc · 6,487 bytesreferences/permission-analysis.mddoc · 4,281 bytesreferences/prompt-injection-patterns.mddoc · 6,525 bytesscripts/scan_skill.pyruns · 29,624 bytes
Read excerpt
# Skill Security Scanner
Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks.
**Requires**: The `uv` CLI for python package management, install guide at https://docs.astral.sh/uv/getting-started/installation/
**Important**: Run all scripts from the repository root. Script paths like `scripts/scan_skill.py` are relative to this skill's root directory (the directory containing this SKILL.md), not relative to the target repository.
## Bundled Script
### `scripts/scan_skill.py`
Static analysis scanner that detects deterministic patterns. Outputs structured JSON.
