audit-skills

Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/audit-skills/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, concrete pattern catalog with a clear step sequence, but it lacks executable scanning methodology, a scoring rubric, and explicit validation checkpoints, and it inlines a substantial threat catalog that could be offloaded to a reference file.

Suggestions

Add concrete, executable detection steps (e.g., grep/ripgrep patterns or a scanner script invocation) so Claude can run the audit rather than only eyeball patterns.

Provide the 0-10 scoring rubric explicitly in the Reporting step, and add a false-positive verification checkpoint (flag → confirm context → report) to introduce a validation feedback loop.

Move the 9-category platform threat catalog into a separate references file (e.g., THREAT_PATTERNS.md) and signal it one level deep from SKILL.md to improve progressive disclosure and token efficiency.

Dimension	Reasoning	Score
Conciseness	The body is mostly a lean pattern catalog (e.g., "`sudo`, `chown`, `chmod`, `TakeOwnership`", "`Base64`, `Hex`, `XOR` loops"), but includes minor removable padding such as the stray template line "2-4 sentences is perfect." and a verbatim repeat of the description under Overview, keeping it just below the lean 5-anchor.	4 / 5
Actionability	Concrete indicators are listed (specific commands like "`adb shell`, `pm install`, `am start`" and "`reg add` (Run keys), `schtasks`"), but there is no executable scanning procedure (e.g., grep/scan commands) and the Reporting step promises a "score (0-10)" without any scoring rubric, leaving key details incomplete.	3 / 5
Workflow Clarity	A clear 3-step sequence exists ("Step 1: Static Analysis", "Step 2: Platform-Specific Threat Detection", "Step 3: Reporting"), but validation checkpoints are only implicit — there is no false-positive verification step or report-validation feedback loop — matching the anchor where steps are listed but checkpoints are missing.	3 / 5
Progressive Disclosure	Sections are well-organized (Overview, When to Use, How It Works, Examples, Best Practices, Limitations), but no bundle files exist and the large 9-category threat pattern catalog is inlined entirely in SKILL.md rather than split into a one-level-deep reference, so content that could be separate stays inline.	3 / 5
	Total	13 / 20 Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description states a clear, specific capability and covers natural trigger terms well, but it omits any explicit "Use when…" guidance, which caps completeness and leaves the trigger context implicit.

Suggestions

Append an explicit trigger clause, e.g. "Use when auditing AI skills or bundles for security vulnerabilities, or when the user asks to verify skill legitimacy or scan for cross-platform/mobile threats."

Reframe the detection targets as multiple concrete verbs (e.g., "flags privilege-escalation commands, detects data-exfiltration patterns, and identifies obfuscated payloads") to push specificity toward comprehensive coverage.

Add a few natural synonyms such as "vulnerability scan" or "malware check" to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Quotes "Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads" — names the domain plus several concrete detection targets, but it is essentially one action (static analysis) with enumerated objects rather than multiple distinct verbs, so it sits just below the comprehensive 5-anchor.	4 / 5
Completeness	The "what" is explicit ("Performs non-intrusive static analysis to identify malicious patterns…"), but there is no "Use when…" clause or equivalent explicit trigger guidance for "when", which per the judging guidelines caps completeness at 3.	3 / 5
Trigger Term Quality	Quotes natural terms like "security auditor", "audit", "security reviews", and "mobile threats" that a user would plausibly say, giving good keyword coverage; a few synonyms (e.g., "vulnerability scan", "malware check") are missing, so it does not reach the comprehensive 5-anchor.	4 / 5
Distinctiveness Conflict Risk	Quotes the niche "security auditor for AI Skills and Bundles" with a cross-platform scope, making it mostly distinct with only minor overlap risk against generic security-scanning skills (the body itself references a related @security-scanner).	4 / 5
	Total	15 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/agentic-awesome-skills
Path: skills/audit-skills/SKILL.md
Commit: b1aebac

Reviewed: ~19 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.