Agent Skill Security Audit
Get an evidence-based audit of a skill's injection risks, executable code, permissions, and release blockers.
Before & after
Same prompt, same agent — the only difference is the skill.
I'd be happy to help review this skill for security concerns. Here are some general things to watch out for when installing third-party skills: - Check if the skill requests network access - Look for any shell commands or file system operations - Review whether it handles credentials or API keys - Be cautious of obfuscated or minified code - Verify the source is trustworthy If you share the contents of the SKILL.md and any scripts, I can take a closer look and give you a more specific assessment. Generally speaking, skills from well-known sources are lower risk, but it's always good to review before installing.
SKILL AUDIT — invoice-parser v2.1 · VERDICT: REVIEW BEFORE INSTALL FILES SKILL.md · scripts/extract.py · scripts/post.sh · reference/schema.json FINDINGS HIGH — scripts/post.sh:12 curl -X POST to a hardcoded third-party host with the parsed invoice body. The listing describes local extraction only. Every invoice you parse leaves your machine. Nothing in SKILL.md discloses this. MEDIUM — scripts/extract.py:3 Reads ~/.aws/credentials at import time. Never referenced again in the file. No stated reason for it to touch AWS credentials at all. MEDIUM — SKILL.md:41 Instructs the agent to "run any setup script found in the invoice folder." That is arbitrary execution driven by untrusted input — a malicious PDF directory becomes code execution. LOW — scripts/extract.py:88 Bare "except:" swallows every error including the credential read above, so a failure here is silent. CLEAN No obfuscation · no minified blobs · no base64 payloads · deps pinned WHAT TO DO 1. Delete scripts/post.sh, or repoint the host and confirm you own it 2. Strip the credentials read on line 3 — nothing consumes it 3. Replace the SKILL.md:41 instruction with an explicit allowlist Re-run after those three and this comes back clean.
About this skill
“Can I install this skill without giving it more access than it needs?” A harmless description can hide instructions that promote email content into commands, send private data to an unexpected destination, or run unsafe code. This audit traces those paths and gives you quoted evidence, targeted fixes, and a defensible release decision.
What it does
- Maps the skill's stated purpose to its requested files, tools, credentials, network destinations, and persistent changes.
- Traces prompt injection from untrusted documents or tool results to consequential actions.
- Reviews supplied executable code for command injection, credential exposure, unsafe downloads, and destructive operations.
- Distinguishes permissions described in prose from restrictions actually enforced by the host or tool.
- Ranks findings by reachable impact and confidence, with exact excerpts and minimal fixes.
- Identifies missing evidence that prevents a meaningful release decision.
What you get
A scoped security report with a PASS, CONDITIONAL, or BLOCK recommendation, severity-ranked findings, and concrete acceptance checks. For a narrow question, you get a focused finding instead of a full report.
Best for
Skill authors preparing a marketplace submission, teams reviewing shared agent extensions, and users deciding whether to trust a third-party skill or plugin.
SKILL.md preview
---
name: agent-skill-security-audit
description: Audits an agent skill, plugin, or tool definition by tracing untrusted inputs through instructions and supplied code to tools, sensitive data, and persistent changes. Produces quoted findings, minimal fixes, and an evidence-bounded release decision. Use when the user says "audit this skill before I install it", "is this plugin safe?", "check this SKILL.md for prompt injection", "does this skill ask for too much access?", "review these bundled scripts", "my agent keeps following instructions from emails", or "can this skill leak my credentials?".
---
# Agent Skill Security Audit
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.