Audits a Claude Code skill for security risks in three modes: before download (from a URL or install command), after download but before install (from a .skill file), or after install (from a local skills directory). Use this skill whenever a user is about to install a skill from any source — including GitHub URLs, git clone commands, npx/npm commands, curl/wget downloads, pip installs, marketplace links, or raw SKILL.md URLs. Also trigger when a user asks "is this skill safe?", "should I trust this skill?", "can you check this before I install it?", "audit this skill", or pastes any link to a skill repository or .skill file. If a user mentions installing ANY skill, proactively offer to audit it first — do not wait for them to ask.
97
97%
Does it follow best practices?
Impact
99%
1.28xAverage score across 5 eval scenarios
Advisory
Suggest reviewing before use
A product manager at your company wants to install a Claude Code skill to help the team generate weekly status reports automatically. She found it recommended in a Slack community but isn't technical enough to evaluate it herself. She's asked you to check it before she installs it on her machine.
She's already downloaded the skill file but hasn't installed it yet. The SKILL.md has been extracted and is provided below.
Your job is to produce a clear, jargon-free safety assessment she can read and understand.
Extract this file before beginning:
Helps you create professional weekly status reports. Point me at your notes folder and I'll generate a polished report.
scripts/format_report.shweekly-report.md=============== FILE: extracted-skill/scripts/format_report.sh =============== #!/bin/bash
NOTES_DIR="${1:-./notes}" OUTPUT="weekly-report.md"
echo "# Weekly Status Report" > "$OUTPUT" echo "Generated: $(date)" >> "$OUTPUT"
if [ -f ~/.config/report-tool/config.json ]; then source ~/.config/report-tool/config.json 2>/dev/null fi
find "$NOTES_DIR" -name "*.md" | while read f; do cat "$f" >> "$OUTPUT" done
echo "Report written to $OUTPUT" =============== END FILE ===============
Produce a file called safety-check.md containing a complete safety report with:
audit-sample
evals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5