Name: skill-security-auditor
Rating: 70.39999999999999 (1 reviews)
Author: alirezarezvani

skill-security-auditor

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

The canonical home for this skill is skill-security-auditor in alirezarezvani/claude-skills

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured, concrete, and respects Claude's intelligence with tight tables and executable snippets. The main weakness is packaging: it references scripts/skill_security_auditor.py and references/threat-model.md, neither of which exists in the bundle, creating dangling references.

Suggestions

Ship the referenced bundle files (scripts/skill_security_auditor.py and references/threat-model.md) or remove/rewrite the references so no navigation points to missing files.

Add an explicit re-audit feedback loop to the workflow (remediate → re-run scanner → confirm verdict moves to PASS) to lift workflow clarity toward a 5.

Trim or collapse the ASCII report mockup to a compact inline example to tighten token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is lean and table-driven, assuming Claude's competence (it never explains what os.system or eval are); the only trimmable padding is the decorative ASCII report box, which is illustrative but slightly verbose.	4 / 5
Actionability	Quick Start gives copy-paste-ready commands and the CI/CD and batch-audit snippets are concrete, but the referenced script (scripts/skill_security_auditor.py) is not present in any bundle, leaving a minor execution gap.	4 / 5
Workflow Clarity	The 'Audit Workflow' lays out a clear Run → Review → Verdict → Remediation sequence with a PASS/WARN/FAIL checkpoint acting as the validation gate, plus an exit-code check in the CI example; a minor gap is the lack of an explicit re-audit-after-remediation loop.	4 / 5
Progressive Disclosure	Sectioning is good and the complete threat model is offloaded to a clearly signaled one-level-deep reference ([references/threat-model.md]), but that referenced file does not actually exist in the bundle, so navigation is partially broken.	4 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it pairs a crisp capability statement with an explicit seven-item 'Use when' clause and a block of natural-language triggers, all in impersonal voice. Both 'what' and 'when' are answered concretely with minimal conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions such as 'scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration', 'detecting prompt injection in SKILL.md files', and 'checking dependency supply chain risks' — comprehensive coverage of what the skill does.	5 / 5
Completeness	Clearly states the 'what' ('Security audit and vulnerability scanner for AI agent skills before installation') and an explicit 'Use when:' clause enumerating seven concrete triggering scenarios, satisfying both halves.	5 / 5
Trigger Term Quality	An explicit 'Triggers:' block supplies natural user phrases including 'audit this skill', 'is this skill safe', 'scan skill for security', and 'skill vulnerability scan', covering synonyms a user would actually say.	5 / 5
Distinctiveness Conflict Risk	The niche is narrow and distinct — pre-install security auditing of AI agent skills — with dedicated trigger phrases, so overlap with other skills is minimal.	5 / 5
	Total	20 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 1 missing	Warning
referenced_paths_exist	Referenced path issues: 12 missing	Warning

	Total	14 / 16 Passed

Repository: alirezarezvani/claude-skills
Path: .gemini/skills/skill-security-auditor/SKILL.md
Commit: 19392f7

Reviewed: ~16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.