A security scanner for agent skills. Scan a Claude/agent Skill for prompt-injection, dangerous shell, secret access, and network exfiltration before you trust it — one command, zero dependencies, SARIF output for CI.
npx @royalpinto007/skill-audit ./path-to-skill
Requires Node.js 18+.
No install — npx fetches and runs the package:
npx @royalpinto007/skill-audit ./my-skillOr install once and call skill-audit directly:
npm install -g @royalpinto007/skill-audit
skill-audit ./my-skillPoint <path> at a skill directory or a single SKILL.md. Expected output on a clean skill:
skill-audit · my-skill (1 file scanned)
✓ No issues found.
(File count depends on how many scripts and text files the skill contains.)
Agent skills are the new plugin. A skill is a SKILL.md plus scripts that an agent will read as instructions and execute — and people install them from GitHub, gists, and marketplaces with zero review. That is an unguarded supply chain: a skill can quietly tell the agent to ignore its own rules, curl | bash a payload, read your ~/.ssh keys, or POST your .env to a webhook, and nothing checks for it.
skill-audit is npm audit for skills. Point it at a skill and it flags the patterns that should stop you from installing it.
| Category | Examples |
|---|---|
| Prompt injection | "ignore all previous instructions", "do not tell the user", "act without confirmation", disable/bypass safety, stated intent to exfiltrate |
| Dangerous shell | rm -rf ~, curl | bash, fork bombs, chmod 777, dd/mkfs, reverse shells |
| Secret access | reads ~/.ssh/id_rsa, ~/.aws/credentials, .npmrc, .netrc, dumps the environment, hits the keychain |
| Exfiltration | uploads local files, contacts webhook.site / pastebin / ngrok / raw IPs, programmatic outbound POST |
| Supply chain | runtime pip/npm installs, git clone && run |
| Obfuscation | base64 -d | sh, large base64 blobs, hidden zero-width / bidi Unicode |
| Over-permission | allowed-tools: * |
It reads SKILL.md prose for instruction-injection and reads scripts and fenced code blocks for dangerous commands — so a chmod 777 mentioned in a sentence won't false-positive, but the same command in a code block will.
Directory scans include .bat, .cmd, .fish, and .psm1 scripts alongside the other supported script and text formats. Extensions are matched case-insensitively, including in nested directories.
Privilege escalation rule SKILL-SH-003 flags sudo, doas, and run0 in
scripts and fenced code, with medium severity.
See every rule: npx @royalpinto007/skill-audit --rules.
npx @royalpinto007/skill-audit <path> [options]
# scan a skill directory
npx @royalpinto007/skill-audit ~/.claude/skills/some-skill
# fail CI on anything medium or worse
npx @royalpinto007/skill-audit ./my-skill --fail-on medium
# machine-readable output
npx @royalpinto007/skill-audit ./my-skill --format json
npx @royalpinto007/skill-audit ./my-skill --format sarif > skill-audit.sarifOptions
| Flag | Default | Meaning |
|---|---|---|
--format <text|json|sarif> |
text |
output format |
--fail-on <severity> |
high |
exit 1 if any finding is at or above this severity |
--rules |
list every rule and exit | |
-h, --help / -v, --version |
Exit codes: 0 clean (below threshold) · 1 findings at/above --fail-on · 2 bad usage.
Pass at most one target path per invocation; extra paths are rejected with exit code 2 before scanning. With no path, the current directory is scanned.
Unknown options are rejected with exit code 2 before scanning, so a misspelled flag cannot silently change the scan.
One line — drop it into any workflow. It gates the job and can upload findings to the Security tab:
name: skill-audit
on: [pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: AgentPostmortem/skill-audit@v1
with:
path: ./skills # default "."
fail-on: high # critical|high|medium|low|info
sarif-file: skill-audit.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: skill-audit.sarifPrefer the raw CLI? npx @royalpinto007/skill-audit ./skills --fail-on high works the same in any pipeline.
- It's a fast static heuristic — a first line of defense that catches the obvious and the sneaky-but-known. Green is not a proof of safety; read skills you run.
- It has no runtime dependencies — a security tool shouldn't pull a supply chain of its own.
- False positives are possible by design (it errs toward flagging). Tune with
--fail-on.
Part of a small agent-security toolkit: mcp-audit (scan MCP servers), injection-arena (learn prompt-injection defense), and the awesome-llm-guardrails list.
MIT