Skill Security Auditor
Runs a structured audit over a skill's instructions, scripts, and declared tool access to catch prompt-injection risk and scope creep before it ships.
Before & after
Same prompt, same agent — the only difference is the skill.
I'd be happy to help review this skill for security concerns. Here are some general things to watch out for when installing third-party skills: - Check if the skill requests network access - Look for any shell commands or file system operations - Review whether it handles credentials or API keys - Be cautious of obfuscated or minified code - Verify the source is trustworthy If you share the contents of the SKILL.md and any scripts, I can take a closer look and give you a more specific assessment. Generally speaking, skills from well-known sources are lower risk, but it's always good to review before installing.
SKILL AUDIT — invoice-parser v2.1 · VERDICT: REVIEW BEFORE INSTALL FILES SKILL.md · scripts/extract.py · scripts/post.sh · reference/schema.json FINDINGS HIGH — scripts/post.sh:12 curl -X POST to a hardcoded third-party host with the parsed invoice body. The listing describes local extraction only. Every invoice you parse leaves your machine. Nothing in SKILL.md discloses this. MEDIUM — scripts/extract.py:3 Reads ~/.aws/credentials at import time. Never referenced again in the file. No stated reason for it to touch AWS credentials at all. MEDIUM — SKILL.md:41 Instructs the agent to "run any setup script found in the invoice folder." That is arbitrary execution driven by untrusted input — a malicious PDF directory becomes code execution. LOW — scripts/extract.py:88 Bare "except:" swallows every error including the credential read above, so a failure here is silent. CLEAN No obfuscation · no minified blobs · no base64 payloads · deps pinned WHAT TO DO 1. Delete scripts/post.sh, or repoint the host and confirm you own it 2. Strip the credentials read on line 3 — nothing consumes it 3. Replace the SKILL.md:41 instruction with an explicit allowlist Re-run after those three and this comes back clean.
About this skill
name: skill-security-auditor description: Use when Structured Claude skill that gives Claude a repeatable workflow for skill security auditor.
Skill Security Auditor
One of 337+ skills in the original author's multi-agent claude-skills mega-collection (~19k GitHub stars). Packages the Skill Security Auditor workflow with its own instructions and validation so outputs stay consistent.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the skill-security-auditor skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Skill Security Auditor; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: skill-security-auditor
description: Use when an agent skill, plugin, or tool definition needs a security audit before being trusted or distributed.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Skill Security Auditor
Runs a structured audit over a skill's instructions, scripts, and declared tool access to catch prompt-injection risk and scope creep before it ships.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.